Move netx URL/token into DSH host settings and credentials.

Mount MCP from dsh-netxops instead of OS env in the agent preset.

scripts/set-netx-token.ps1

@@ -0,0 +1,38 @@
+# Set NETX_API_TOKEN in the DSH credentials store (no OS env required).
+
+param(
+  [Parameter(Mandatory = $true)]
+  [string] $Token,
+  [string] $DshHome = $(if ($env:DSH_HOME) { $env:DSH_HOME } else { Join-Path $env:USERPROFILE ".dsh" })
+)
+
+$ErrorActionPreference = "Stop"
+if ([string]::IsNullOrWhiteSpace($Token)) { throw "Token is empty" }
+
+New-Item -ItemType Directory -Force -Path $DshHome | Out-Null
+$path = Join-Path $DshHome ".credentials.yaml"
+
+# Minimal merge: preserve other refs if file exists and is simple version:1 docs.
+$escaped = $Token.Replace("'", "''")
+if (-not (Test-Path $path)) {
+  @"
+version: 1
+
+refs:
+  NETX_API_TOKEN: '$escaped'
+"@ | Set-Content -Path $path -Encoding utf8
+  Write-Host "Created $path with NETX_API_TOKEN"
+  exit 0
+}
+
+$raw = Get-Content -Path $path -Raw
+if ($raw -match '(?m)^\s*NETX_API_TOKEN\s*:') {
+  $raw = [regex]::Replace($raw, '(?m)^(\s*NETX_API_TOKEN\s*:\s*).*$', "`${1}'$escaped'")
+} elseif ($raw -match '(?m)^refs\s*:') {
+  $raw = [regex]::Replace($raw, '(?m)^(refs\s*:\s*\r?\n)', "`${1}  NETX_API_TOKEN: '$escaped'`n")
+} else {
+  $raw = $raw.TrimEnd() + "`n`nrefs:`n  NETX_API_TOKEN: '$escaped'`n"
+}
+Set-Content -Path $path -Value $raw -Encoding utf8
+Write-Host "Updated NETX_API_TOKEN in $path"
+Write-Host "If dsh is running, wait for credential reload or restart dsh web."

scripts/set-netx-token.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -euo pipefail
+TOKEN="${1:-}"
+if [[ -z "$TOKEN" ]]; then
+  echo "usage: $0 <NETX_API_TOKEN>" >&2
+  exit 1
+fi
+DSH_HOME="${DSH_HOME:-$HOME/.dsh}"
+mkdir -p "$DSH_HOME"
+PATH_FILE="$DSH_HOME/.credentials.yaml"
+ESC=${TOKEN//\'/\'\'}
+
+if [[ ! -f "$PATH_FILE" ]]; then
+  cat >"$PATH_FILE" <<EOF
+version: 1
+
+refs:
+  NETX_API_TOKEN: '$ESC'
+EOF
+  echo "Created $PATH_FILE with NETX_API_TOKEN"
+  exit 0
+fi
+
+if grep -qE '^[[:space:]]*NETX_API_TOKEN[[:space:]]*:' "$PATH_FILE"; then
+  # portable-ish in-place replace
+  tmp="$(mktemp)"
+  sed -E "s|^([[:space:]]*NETX_API_TOKEN[[:space:]]*:[[:space:]]*).*$|\1'$ESC'|" "$PATH_FILE" >"$tmp"
+  mv "$tmp" "$PATH_FILE"
+else
+  if grep -qE '^refs[[:space:]]*:' "$PATH_FILE"; then
+    tmp="$(mktemp)"
+    awk -v tok="$ESC" '
+      BEGIN{done=0}
+      /^refs[[:space:]]*:/ && !done { print; print "  NETX_API_TOKEN: '\''" tok "'\''"; done=1; next }
+      { print }
+    ' "$PATH_FILE" >"$tmp"
+    mv "$tmp" "$PATH_FILE"
+  else
+    printf '\nrefs:\n  NETX_API_TOKEN: '\''%s'\''\n' "$ESC" >>"$PATH_FILE"
+  fi
+fi
+echo "Updated NETX_API_TOKEN in $PATH_FILE"
+echo "If dsh is running, wait for credential reload or restart dsh web."