# Internal system access

All internal system requests must go through agent-sidecar. For the systems in
the route table below, the runtime supplies `DS_PROXY_URL`, an HTTP base URL
whose requests are forwarded to Sidecar. Require this variable before using
those helpers; Lark uses the dedicated Auth Proxy described below. Never infer
a direct upstream URL. The bundled helpers do not load `.env` files.
Only non-secret proxy settings and operation parameters belong in Agent-authored configuration.
The Lark CLI may consume its runtime-injected proxy signing key automatically;
never inspect, print, copy, or persist that key. Real upstream credentials stay in Sidecar.

- Use the bundled proxy-aware helpers. Sidecar owns API credentials and operation
  authorization. Do not read, request, store, or send tokens, API keys, cookies,
  credential files, or AWS credentials, and do not run login/token-exchange flows.
- If the proxy is unavailable, a route is missing, or an operation is denied,
  report the affected system, operation, HTTP status, and missing evidence. Do
  not retry through a direct URL, another CLI, browser session, or credential
  source. Retries to the same proxy for transient errors are allowed.
- Preserve the requested environment. `DEVOPS_ENV` defaults to `prod`; a task's
  explicit environment overrides it. Never silently switch environments.
- Use only configured routes and authorized operations. Proxy availability does
  not authorize writes; preserve the user's task scope and each skill's limits.
- Upstream URLs in responses, tickets, and documents are references. Reconstruct
  supported API requests under the matching proxy prefix; do not follow upstream
  URLs or redirects directly. Human-facing links may retain their original URLs.

## Route conventions

These prefixes describe the client convention, not a guarantee that a route or
operation is enabled in this runtime.

| System | Path relative to DS_PROXY_URL |
| --- | --- |
| DevOps, Core Server, jsm-syncer, Alertstore | `/devops/{env}` followed by the original API path |
| Ticket Manager | `/devops/prod/ticket-manager` followed by `/api/v1/ticketmanager` |
| Jira / JSM | `/jira` followed by the REST path |
| Clinic | `/clinic/{env}` followed by the original API path |
| O11y regional queries | `/o11y/ds/{region}/{vendor}` followed by the query path |
| O11y global queries | `/o11y/gs` followed by the query path |
| GitHub Git clone/fetch | `/github/{owner}/{repository}.git` |

For a documented API without a bundled helper, use curl through the same proxy:

```bash
curl --disable --noproxy '*' --fail-with-body --silent --show-error \
  --max-time 30 "${DS_PROXY_URL:?DS_PROXY_URL is required}/jira/rest/api/3/myself"
```

Do not add authentication headers or enable redirects. Git clone/fetch uses the
explicit proxy repository URL with credential helpers disabled:

```bash
git -c credential.helper= -c http.extraHeader= -c http.followRedirects=false \
  clone "${DS_PROXY_URL:?DS_PROXY_URL is required}/github/OWNER/REPOSITORY.git"
```

GitHub REST API, Git push, O11y export, and S3 operations are
unavailable unless a corresponding proxy capability is explicitly provided.
Do not call `/o11y/credentials` or obtain credentials to execute them directly.
## Feishu / Lark

Lark uses `LARKSUITE_CLI_AUTH_PROXY`, a dedicated loopback HTTP listener, rather
than `DS_PROXY_URL`. Read the bundled `lark-shared` skill and run its configuration
check before network operations. Use the image's authsidecar-enabled `lark-cli`
with `--as bot`; the CLI reads `LARKSUITE_CLI_PROXY_KEY` from its environment for
signing, and Sidecar alone resolves and injects the actual Feishu access token.

Missing configuration or unsupported operations are reported without login,
credential discovery, identity switching, direct requests, or CLI self-updates.
User-only operations, MCP and direct pre-signed downloads are unavailable.
Public API documentation may be read to understand a command; business API
calls still require the proxy and an allowed operation. Existing task
permissions remain authoritative for writes.