@exagone313/dsh-podman 0.2.0-rc.3 → 0.2.0

package/dist/client/tool-views.js

@@ -3,46 +3,194 @@ import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-run
 //
 // SPDX-License-Identifier: MIT
 import { useState } from "react";
-import { DisclosureRow, IconApiOutline14, IconArchiveOutline20, IconBrowseOutline16, IconDataOutline16, IconEditOutline16, IconFolderOpenOutline16, IconLinkOutline16, IconPlayOutline16, IconPlusOutline16, IconRefreshOutline16, IconSearchOutline16, IconSparkle16, IconStopFill16, IconTrashOutline16, StateDot, TerminalBlock, } from "@deepseek-ai/dsh-client-ui-primitives";
+import { DisclosureRow, IconApiOutlineRegular, IconArchiveOutlineRegular, IconBrowseOutlineRegular, IconDataOutlineRegular, IconEditOutlineRegular, IconFolderOpenOutlineRegular, IconLinkOutlineRegular, IconPlayOutlineRegular, IconPlusOutlineRegular, IconRefreshOutlineRegular, IconSearchOutlineRegular, IconSparkleRegular, IconStopFillRegular, IconTrashOutlineRegular, StateDot, TerminalBlock, } from "@deepseek-ai/dsh-client-ui-primitives";
 import { TERMINAL_CLASS } from "./terminal-styles.js";
 const TOOL_PRESENTATION = {
-    container_bash: { titleKey: "toolTitle_container_bash", icon: _jsx(IconApiOutline14, { size: 14 }), summaryKeys: ["description", "command"] },
-    container_exec: { titleKey: "toolTitle_container_exec", icon: _jsx(IconApiOutline14, { size: 14 }), summaryKeys: ["description", "argv"] },
-    container_read: { titleKey: "toolTitle_container_read", icon: _jsx(IconBrowseOutline16, { size: 14 }), summaryKeys: ["file_path"] },
-    container_write: { titleKey: "toolTitle_container_write", icon: _jsx(IconEditOutline16, { size: 14 }), summaryKeys: ["file_path"] },
-    container_edit: { titleKey: "toolTitle_container_edit", icon: _jsx(IconEditOutline16, { size: 14 }), summaryKeys: ["file_path"] },
-    container_glob: { titleKey: "toolTitle_container_glob", icon: _jsx(IconSearchOutline16, { size: 14 }), summaryKeys: ["pattern"] },
-    container_grep: { titleKey: "toolTitle_container_grep", icon: _jsx(IconSearchOutline16, { size: 14 }), summaryKeys: ["pattern"] },
-    container_list: { titleKey: "toolTitle_container_list", icon: _jsx(IconDataOutline16, { size: 14 }), summaryKeys: [] },
-    container_start: { titleKey: "toolTitle_container_start", icon: _jsx(IconPlayOutline16, { size: 14 }), summaryKeys: ["container", "image"] },
-    container_recreate: { titleKey: "toolTitle_container_recreate", icon: _jsx(IconRefreshOutline16, { size: 14 }), summaryKeys: ["container", "image"] },
-    container_remove: { titleKey: "toolTitle_container_remove", icon: _jsx(IconTrashOutline16, { size: 14 }), summaryKeys: ["container"] },
-    container_mount_list: { titleKey: "toolTitle_container_mount_list", icon: _jsx(IconFolderOpenOutline16, { size: 14 }), summaryKeys: ["container"] },
-    container_mount_add: { titleKey: "toolTitle_container_mount_add", icon: _jsx(IconFolderOpenOutline16, { size: 14 }), summaryKeys: ["container", "kind"] },
-    container_mount_remove: { titleKey: "toolTitle_container_mount_remove", icon: _jsx(IconTrashOutline16, { size: 14 }), summaryKeys: ["container"] },
-    container_mount_update: { titleKey: "toolTitle_container_mount_update", icon: _jsx(IconRefreshOutline16, { size: 14 }), summaryKeys: ["container", "mode"] },
-    container_path_set: { titleKey: "toolTitle_container_path_set", icon: _jsx(IconEditOutline16, { size: 14 }), summaryKeys: ["container"] },
-    container_path_add: { titleKey: "toolTitle_container_path_add", icon: _jsx(IconPlusOutline16, { size: 14 }), summaryKeys: ["container", "path"] },
-    container_path_remove: { titleKey: "toolTitle_container_path_remove", icon: _jsx(IconTrashOutline16, { size: 14 }), summaryKeys: ["container", "path"] },
-    container_secret_add: { titleKey: "toolTitle_container_secret_add", icon: _jsx(IconLinkOutline16, { size: 14 }), summaryKeys: ["container", "env"] },
-    container_secret_remove: { titleKey: "toolTitle_container_secret_remove", icon: _jsx(IconLinkOutline16, { size: 14 }), summaryKeys: ["container", "env"] },
-    image_list: { titleKey: "toolTitle_image_list", icon: _jsx(IconArchiveOutline20, { size: 14 }), summaryKeys: [] },
-    image_get: { titleKey: "toolTitle_image_get", icon: _jsx(IconArchiveOutline20, { size: 14 }), summaryKeys: ["imageId"] },
-    image_build: { titleKey: "toolTitle_image_build", icon: _jsx(IconPlusOutline16, { size: 14 }), summaryKeys: ["imageId", "parent"] },
-    image_rebuild: { titleKey: "toolTitle_image_rebuild", icon: _jsx(IconRefreshOutline16, { size: 14 }), summaryKeys: ["imageId"] },
-    image_rebuild_all: { titleKey: "toolTitle_image_rebuild_all", icon: _jsx(IconRefreshOutline16, { size: 14 }), summaryKeys: [] },
-    image_remove: { titleKey: "toolTitle_image_remove", icon: _jsx(IconTrashOutline16, { size: 14 }), summaryKeys: ["imageId"] },
-    volume_list: { titleKey: "toolTitle_volume_list", icon: _jsx(IconDataOutline16, { size: 14 }), summaryKeys: [] },
-    volume_create: { titleKey: "toolTitle_volume_create", icon: _jsx(IconPlusOutline16, { size: 14 }), summaryKeys: ["name"] },
-    volume_remove: { titleKey: "toolTitle_volume_remove", icon: _jsx(IconTrashOutline16, { size: 14 }), summaryKeys: ["name"] },
-    secret_list: { titleKey: "toolTitle_secret_list", icon: _jsx(IconLinkOutline16, { size: 14 }), summaryKeys: [] },
-    secret_create: { titleKey: "toolTitle_secret_create", icon: _jsx(IconPlusOutline16, { size: 14 }), summaryKeys: ["name"] },
-    secret_remove: { titleKey: "toolTitle_secret_remove", icon: _jsx(IconTrashOutline16, { size: 14 }), summaryKeys: ["name"] },
-    daemon_start: { titleKey: "toolTitle_daemon_start", icon: _jsx(IconPlayOutline16, { size: 14 }), summaryKeys: ["name"] },
-    daemon_list: { titleKey: "toolTitle_daemon_list", icon: _jsx(IconPlayOutline16, { size: 14 }), summaryKeys: ["container"] },
-    daemon_logs: { titleKey: "toolTitle_daemon_logs", icon: _jsx(IconBrowseOutline16, { size: 14 }), summaryKeys: ["name"] },
-    daemon_restart: { titleKey: "toolTitle_daemon_restart", icon: _jsx(IconRefreshOutline16, { size: 14 }), summaryKeys: ["name"] },
-    daemon_stop: { titleKey: "toolTitle_daemon_stop", icon: _jsx(IconStopFill16, { size: 14 }), summaryKeys: ["name"] },
+    container_bash: {
+        titleKey: "toolTitle_container_bash",
+        icon: _jsx(IconApiOutlineRegular, { size: 14 }),
+        summaryKeys: ["description", "command"],
+    },
+    container_exec: {
+        titleKey: "toolTitle_container_exec",
+        icon: _jsx(IconApiOutlineRegular, { size: 14 }),
+        summaryKeys: ["description", "argv"],
+    },
+    container_read: {
+        titleKey: "toolTitle_container_read",
+        icon: _jsx(IconBrowseOutlineRegular, { size: 14 }),
+        summaryKeys: ["file_path"],
+    },
+    container_write: {
+        titleKey: "toolTitle_container_write",
+        icon: _jsx(IconEditOutlineRegular, { size: 14 }),
+        summaryKeys: ["file_path"],
+    },
+    container_edit: {
+        titleKey: "toolTitle_container_edit",
+        icon: _jsx(IconEditOutlineRegular, { size: 14 }),
+        summaryKeys: ["file_path"],
+    },
+    container_glob: {
+        titleKey: "toolTitle_container_glob",
+        icon: _jsx(IconSearchOutlineRegular, { size: 14 }),
+        summaryKeys: ["pattern"],
+    },
+    container_grep: {
+        titleKey: "toolTitle_container_grep",
+        icon: _jsx(IconSearchOutlineRegular, { size: 14 }),
+        summaryKeys: ["pattern"],
+    },
+    container_list: {
+        titleKey: "toolTitle_container_list",
+        icon: _jsx(IconDataOutlineRegular, { size: 14 }),
+        summaryKeys: [],
+    },
+    container_start: {
+        titleKey: "toolTitle_container_start",
+        icon: _jsx(IconPlayOutlineRegular, { size: 14 }),
+        summaryKeys: ["container", "image"],
+    },
+    container_recreate: {
+        titleKey: "toolTitle_container_recreate",
+        icon: _jsx(IconRefreshOutlineRegular, { size: 14 }),
+        summaryKeys: ["container", "image"],
+    },
+    container_remove: {
+        titleKey: "toolTitle_container_remove",
+        icon: _jsx(IconTrashOutlineRegular, { size: 14 }),
+        summaryKeys: ["container"],
+    },
+    container_mount_list: {
+        titleKey: "toolTitle_container_mount_list",
+        icon: _jsx(IconFolderOpenOutlineRegular, { size: 14 }),
+        summaryKeys: ["container"],
+    },
+    container_mount_add: {
+        titleKey: "toolTitle_container_mount_add",
+        icon: _jsx(IconFolderOpenOutlineRegular, { size: 14 }),
+        summaryKeys: ["container", "kind"],
+    },
+    container_mount_remove: {
+        titleKey: "toolTitle_container_mount_remove",
+        icon: _jsx(IconTrashOutlineRegular, { size: 14 }),
+        summaryKeys: ["container"],
+    },
+    container_mount_update: {
+        titleKey: "toolTitle_container_mount_update",
+        icon: _jsx(IconRefreshOutlineRegular, { size: 14 }),
+        summaryKeys: ["container", "mode"],
+    },
+    container_path_set: {
+        titleKey: "toolTitle_container_path_set",
+        icon: _jsx(IconEditOutlineRegular, { size: 14 }),
+        summaryKeys: ["container"],
+    },
+    container_path_add: {
+        titleKey: "toolTitle_container_path_add",
+        icon: _jsx(IconPlusOutlineRegular, { size: 14 }),
+        summaryKeys: ["container", "path"],
+    },
+    container_path_remove: {
+        titleKey: "toolTitle_container_path_remove",
+        icon: _jsx(IconTrashOutlineRegular, { size: 14 }),
+        summaryKeys: ["container", "path"],
+    },
+    container_secret_add: {
+        titleKey: "toolTitle_container_secret_add",
+        icon: _jsx(IconLinkOutlineRegular, { size: 14 }),
+        summaryKeys: ["container", "env"],
+    },
+    container_secret_remove: {
+        titleKey: "toolTitle_container_secret_remove",
+        icon: _jsx(IconLinkOutlineRegular, { size: 14 }),
+        summaryKeys: ["container", "env"],
+    },
+    image_list: {
+        titleKey: "toolTitle_image_list",
+        icon: _jsx(IconArchiveOutlineRegular, { size: 14 }),
+        summaryKeys: [],
+    },
+    image_get: {
+        titleKey: "toolTitle_image_get",
+        icon: _jsx(IconArchiveOutlineRegular, { size: 14 }),
+        summaryKeys: ["imageId"],
+    },
+    image_build: {
+        titleKey: "toolTitle_image_build",
+        icon: _jsx(IconPlusOutlineRegular, { size: 14 }),
+        summaryKeys: ["imageId", "parent"],
+    },
+    image_rebuild: {
+        titleKey: "toolTitle_image_rebuild",
+        icon: _jsx(IconRefreshOutlineRegular, { size: 14 }),
+        summaryKeys: ["imageId"],
+    },
+    image_rebuild_all: {
+        titleKey: "toolTitle_image_rebuild_all",
+        icon: _jsx(IconRefreshOutlineRegular, { size: 14 }),
+        summaryKeys: [],
+    },
+    image_remove: {
+        titleKey: "toolTitle_image_remove",
+        icon: _jsx(IconTrashOutlineRegular, { size: 14 }),
+        summaryKeys: ["imageId"],
+    },
+    volume_list: {
+        titleKey: "toolTitle_volume_list",
+        icon: _jsx(IconDataOutlineRegular, { size: 14 }),
+        summaryKeys: [],
+    },
+    volume_create: {
+        titleKey: "toolTitle_volume_create",
+        icon: _jsx(IconPlusOutlineRegular, { size: 14 }),
+        summaryKeys: ["name"],
+    },
+    volume_remove: {
+        titleKey: "toolTitle_volume_remove",
+        icon: _jsx(IconTrashOutlineRegular, { size: 14 }),
+        summaryKeys: ["name"],
+    },
+    secret_list: {
+        titleKey: "toolTitle_secret_list",
+        icon: _jsx(IconLinkOutlineRegular, { size: 14 }),
+        summaryKeys: [],
+    },
+    secret_create: {
+        titleKey: "toolTitle_secret_create",
+        icon: _jsx(IconPlusOutlineRegular, { size: 14 }),
+        summaryKeys: ["name"],
+    },
+    secret_remove: {
+        titleKey: "toolTitle_secret_remove",
+        icon: _jsx(IconTrashOutlineRegular, { size: 14 }),
+        summaryKeys: ["name"],
+    },
+    daemon_start: {
+        titleKey: "toolTitle_daemon_start",
+        icon: _jsx(IconPlayOutlineRegular, { size: 14 }),
+        summaryKeys: ["name"],
+    },
+    daemon_list: {
+        titleKey: "toolTitle_daemon_list",
+        icon: _jsx(IconPlayOutlineRegular, { size: 14 }),
+        summaryKeys: ["container"],
+    },
+    daemon_logs: {
+        titleKey: "toolTitle_daemon_logs",
+        icon: _jsx(IconBrowseOutlineRegular, { size: 14 }),
+        summaryKeys: ["name"],
+    },
+    daemon_restart: {
+        titleKey: "toolTitle_daemon_restart",
+        icon: _jsx(IconRefreshOutlineRegular, { size: 14 }),
+        summaryKeys: ["name"],
+    },
+    daemon_stop: {
+        titleKey: "toolTitle_daemon_stop",
+        icon: _jsx(IconStopFillRegular, { size: 14 }),
+        summaryKeys: ["name"],
+    },
 };
 /** The wire tool names this package owns a row for. */
 export const TOOL_VIEW_KEYS = Object.keys(TOOL_PRESENTATION);
@@ -90,6 +238,14 @@ function firstLine(text) {
     const newline = text.indexOf("\n");
     return newline === -1 ? text : text.slice(0, newline);
 }
+// A hard bound on the output lines a result may render, so a multi-megabyte
+// result cannot create an unbounded number of DOM nodes. Small outputs pass
+// through untouched.
+const MAX_RENDERED_LINES = 2000;
+function capLines(text, max) {
+    const lines = text.split("\n");
+    return lines.length <= max ? text : lines.slice(0, max).join("\n");
+}
 function parseArgs(argsRaw) {
     try {
         const parsed = JSON.parse(argsRaw);
@@ -146,12 +302,11 @@ function prettyOutput(text) {
     return text;
 }
 function terminalCard(toolName, args, block, cwd) {
-    if (toolName !== "container_bash" && toolName !== "container_exec")
+    if (toolName !== "container_bash" && toolName !== "container_exec") {
         return null;
+    }
     const command = toolName === "container_bash"
-        ? typeof args.command === "string"
-            ? args.command
-            : ""
+        ? typeof args.command === "string" ? args.command : ""
         : Array.isArray(args.argv)
             ? args.argv.map((word) => String(word)).join(" ")
             : "";
@@ -185,9 +340,9 @@ function terminalCard(toolName, args, block, cwd) {
         return {
             ...base,
             output,
-            ...(signal !== undefined
-                ? { signal }
-                : { exitCode: typeof record.exitCode === "number" ? record.exitCode : 0 }),
+            ...(signal !== undefined ? { signal } : {
+                exitCode: typeof record.exitCode === "number" ? record.exitCode : 0,
+            }),
         };
     }
     catch {
@@ -200,6 +355,7 @@ function terminalLabels(t) {
     return {
         signal: (signal) => t("terminalSignal", { signal }),
         exitCode: (code) => t("terminalExitCode", { code }),
+        noExitCode: t("terminalNoExitCode"),
         running: t("terminalRunning"),
         failed: t("terminalFailed"),
         done: t("terminalDone"),
@@ -215,9 +371,11 @@ function terminalLabels(t) {
 /** Render one podman tool call as an icon-titled, expandable row. */
 export function PodmanToolRow({ toolName, block, cwd, home, inspect, t, }) {
     const presentation = TOOL_PRESENTATION[toolName];
-    const title = presentation === undefined ? toolName : t(presentation.titleKey);
+    const title = presentation === undefined
+        ? toolName
+        : t(presentation.titleKey);
     const settled = "kind" in block;
-    const argsRaw = ((settled ? block.call?.argsRaw : block.argsRaw) ?? "");
+    const argsRaw = (settled ? block.call?.argsRaw : block.argsRaw) ?? "";
     const args = parseArgs(argsRaw);
     const terminal = terminalCard(toolName, args, block, cwd);
     const state = !settled
@@ -235,7 +393,15 @@ export function PodmanToolRow({ toolName, block, cwd, home, inspect, t, }) {
         argSummary(args, presentation?.summaryKeys ?? [], firstLine(argsRaw) || block.callId);
     const [expanded, setExpanded] = useState(false);
     const expandable = terminal !== null || (output !== null && output !== "");
-    const leading = state === "error" ? (_jsx(StateDot, { state: "error" })) : state === "stopped" ? (_jsx(StateDot, { state: "warning" })) : (presentation?.icon ?? _jsx(IconSparkle16, { size: 14 }));
+    const leading = state === "error"
+        ? _jsx(StateDot, { state: "error" })
+        : state === "stopped"
+            ? _jsx(StateDot, { state: "warning" })
+            : (presentation?.icon ?? _jsx(IconSparkleRegular, { size: 14 }));
     void inspect;
-    return (_jsx(DisclosureRow, { icon: leading, title: title, open: expanded && expandable, expandable: expandable, onToggle: () => setExpanded((value) => !value), expandOnRowClick: true, keepContentWhenOpen: true, collapsedContent: _jsxs(_Fragment, { children: [_jsx("span", { style: sepStyle, "aria-hidden": true }), _jsx("span", { style: failureLine !== null ? errorSummaryStyle : summaryStyle, children: summary })] }), children: terminal !== null ? (_jsx(TerminalBlock, { command: terminal.command, cwd: terminal.cwd, home: home, output: terminal.output, exitCode: terminal.exitCode, signal: terminal.signal, running: terminal.running, maxLines: Infinity, className: TERMINAL_CLASS, labels: terminalLabels(t) })) : expandable ? (_jsx("pre", { style: state === "error" ? errorBodyStyle : bodyStyle, children: output })) : null }));
+    return (_jsx(DisclosureRow, { icon: leading, title: title, open: expanded && expandable, expandable: expandable, onToggle: () => setExpanded((value) => !value), expandOnRowClick: true, keepContentWhenOpen: true, collapsedContent: _jsxs(_Fragment, { children: [_jsx("span", { style: sepStyle, "aria-hidden": true }), _jsx("span", { style: failureLine !== null ? errorSummaryStyle : summaryStyle, children: summary })] }), children: terminal !== null
+            ? (_jsx(TerminalBlock, { command: terminal.command, cwd: terminal.cwd, home: home, output: terminal.output, exitCode: terminal.exitCode, signal: terminal.signal, running: terminal.running, maxLines: MAX_RENDERED_LINES, className: TERMINAL_CLASS, labels: terminalLabels(t) }))
+            : expandable
+                ? (_jsx("pre", { style: state === "error" ? errorBodyStyle : bodyStyle, children: capLines(output ?? "", MAX_RENDERED_LINES) }))
+                : null }));
 }

package/dist/container-env.d.ts

@@ -0,0 +1,11 @@
+export declare function mergeDefaultEnv(defaults: Record<string, string> | undefined, env: Record<string, string> | undefined): Record<string, string>;
+export declare function missingDefaultEnv(defaults: Record<string, string> | undefined, env: Record<string, string> | undefined): Record<string, string>;
+export declare function gitIdentityEnv(name: string, email: string): Record<string, string>;
+export declare function readGitIdentity(env: Record<string, string> | undefined): {
+    name: string;
+    email: string;
+};
+export declare const GIT_IDENTITY_KEYS: readonly ["GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL", "GIT_COMMITTER_NAME", "GIT_COMMITTER_EMAIL"];
+export declare function setGitIdentity(env: Record<string, string>, name: string, email: string): Record<string, string>;
+export declare function gitOnlyDrift(server: Record<string, string>, before: Record<string, string>): boolean;
+export declare function commitIdentityAction(server: Record<string, string>, draft: Record<string, string>, next: Record<string, string>): "discard" | "save" | "draft";

package/dist/container-env.js

@@ -0,0 +1,96 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+// The container environment defaults: one global map, seeded into a container
+// when it is created (see mergeDefaultEnv) and left alone by recreates, so a
+// value can be removed again by recreating the container without it.
+// The reserved prefix the orchestrator refuses on a client-supplied variable;
+// a default in that namespace would make container creation fail, so it is
+// dropped instead of sent.
+const RESERVED_ENV_PREFIX = "DSH_PODMAN";
+// mergeDefaultEnv layers the defaults under a container's own environment: the
+// caller's entries win per key, and defaults that cannot be applied (an empty
+// key, or one in the reserved namespace) are dropped.
+export function mergeDefaultEnv(defaults, env) {
+    const merged = {};
+    for (const [key, value] of Object.entries(defaults ?? {})) {
+        if (key === "" || key.startsWith(RESERVED_ENV_PREFIX))
+            continue;
+        merged[key] = value;
+    }
+    return { ...merged, ...(env ?? {}) };
+}
+// missingDefaultEnv returns the defaults a container does not have yet, so a
+// synchronisation can add exactly those and never overwrite an existing value.
+export function missingDefaultEnv(defaults, env) {
+    const missing = {};
+    for (const [key, value] of Object.entries(mergeDefaultEnv(defaults, undefined))) {
+        if (!Object.prototype.hasOwnProperty.call(env ?? {}, key)) {
+            missing[key] = value;
+        }
+    }
+    return missing;
+}
+// gitIdentityEnv turns one name and one email into the four variables git
+// needs: the author and the committer pair are the same identity.
+export function gitIdentityEnv(name, email) {
+    return {
+        GIT_AUTHOR_NAME: name,
+        GIT_AUTHOR_EMAIL: email,
+        GIT_COMMITTER_NAME: name,
+        GIT_COMMITTER_EMAIL: email,
+    };
+}
+// readGitIdentity reads the name and email back out of an environment map (the
+// author pair; the popup writes all four together).
+export function readGitIdentity(env) {
+    return {
+        name: env?.GIT_AUTHOR_NAME ?? "",
+        email: env?.GIT_AUTHOR_EMAIL ?? "",
+    };
+}
+// The four keys gitIdentityEnv owns, in a stable order.
+export const GIT_IDENTITY_KEYS = [
+    "GIT_AUTHOR_NAME",
+    "GIT_AUTHOR_EMAIL",
+    "GIT_COMMITTER_NAME",
+    "GIT_COMMITTER_EMAIL",
+];
+// setGitIdentity returns env with the git identity added (name and email
+// non-empty) or removed (either empty).
+export function setGitIdentity(env, name, email) {
+    const next = { ...env };
+    for (const key of GIT_IDENTITY_KEYS)
+        delete next[key];
+    if (name === "" || email === "")
+        return next;
+    return { ...next, ...gitIdentityEnv(name, email) };
+}
+// gitOnlyDrift answers whether `before` differs from the persisted `server`
+// only inside the git identity keys. When that holds, the identity popup can
+// commit its change directly, because no other default is being edited.
+export function gitOnlyDrift(server, before) {
+    const identity = new Set(GIT_IDENTITY_KEYS);
+    const keys = new Set([...Object.keys(server), ...Object.keys(before)]);
+    for (const key of keys) {
+        if (identity.has(key))
+            continue;
+        if (server[key] !== before[key])
+            return false;
+    }
+    return true;
+}
+// commitIdentityAction decides how the identity popup's result `next` is
+// applied: "discard" when it restores the persisted environment exactly (the
+// popup brought the identity back, so its pending change is dropped), "save"
+// when the only drift from the server is inside the identity keys (committing
+// straight cannot lose any other edit), "draft" otherwise (other defaults are
+// being edited, so the result lands in the draft and the Save button stays in
+// charge). Since setGitIdentity copies every non-identity key, `next` can
+// equal the server only when nothing but the identity was pending, so
+// "discard" never loses another edit.
+export function commitIdentityAction(server, draft, next) {
+    if (JSON.stringify(next) === JSON.stringify(server))
+        return "discard";
+    return gitOnlyDrift(server, draft) ? "save" : "draft";
+}

package/dist/container-env.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/container-env.test.js

@@ -0,0 +1,93 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import test from "node:test";
+import assert from "node:assert/strict";
+import { commitIdentityAction, GIT_IDENTITY_KEYS, gitIdentityEnv, gitOnlyDrift, mergeDefaultEnv, missingDefaultEnv, readGitIdentity, setGitIdentity, } from "./container-env.js";
+test("mergeDefaultEnv seeds defaults under the container's own env", () => {
+    assert.deepEqual(mergeDefaultEnv({ A: "1", B: "2" }, { B: "own", C: "3" }), {
+        A: "1",
+        B: "own",
+        C: "3",
+    });
+    assert.deepEqual(mergeDefaultEnv(undefined, { A: "1" }), { A: "1" });
+    assert.deepEqual(mergeDefaultEnv({ A: "1" }, undefined), { A: "1" });
+});
+test("mergeDefaultEnv drops empty and reserved defaults", () => {
+    assert.deepEqual(mergeDefaultEnv({ "": "x", DSH_PODMAN_GUEST_TOKEN: "x", KEEP: "1" }, {}), { KEEP: "1" });
+    // An explicit value in the reserved namespace is the caller's own doing and
+    // is left to the orchestrator's validation.
+    assert.deepEqual(mergeDefaultEnv({}, { DSH_PODMAN_GUEST_TOKEN: "x" }), {
+        DSH_PODMAN_GUEST_TOKEN: "x",
+    });
+});
+test("missingDefaultEnv reports only the absent keys", () => {
+    assert.deepEqual(missingDefaultEnv({ A: "1", B: "2" }, { B: "own" }), {
+        A: "1",
+    });
+    assert.deepEqual(missingDefaultEnv({ A: "1" }, { A: "own" }), {});
+    assert.deepEqual(missingDefaultEnv(undefined, {}), {});
+});
+test("git identity fills the author and committer pairs", () => {
+    assert.deepEqual(gitIdentityEnv("John Doe", "john.doe@git.example"), {
+        GIT_AUTHOR_NAME: "John Doe",
+        GIT_AUTHOR_EMAIL: "john.doe@git.example",
+        GIT_COMMITTER_NAME: "John Doe",
+        GIT_COMMITTER_EMAIL: "john.doe@git.example",
+    });
+    assert.deepEqual(readGitIdentity(gitIdentityEnv("John Doe", "john.doe@git.example")), {
+        name: "John Doe",
+        email: "john.doe@git.example",
+    });
+    assert.deepEqual(readGitIdentity(undefined), { name: "", email: "" });
+});
+test("setGitIdentity adds, replaces and clears the four keys", () => {
+    const base = { KEEP: "1", GIT_AUTHOR_NAME: "old" };
+    const set = setGitIdentity(base, "new", "new@example.com");
+    assert.deepEqual(set, {
+        KEEP: "1",
+        ...gitIdentityEnv("new", "new@example.com"),
+    });
+    for (const key of GIT_IDENTITY_KEYS)
+        assert.ok(key in set);
+    // An empty field clears the whole identity, leaving other defaults alone.
+    assert.deepEqual(setGitIdentity(set, "", "new@example.com"), { KEEP: "1" });
+    assert.deepEqual(setGitIdentity(set, "new", ""), { KEEP: "1" });
+    // The input map is not mutated.
+    assert.deepEqual(base, { KEEP: "1", GIT_AUTHOR_NAME: "old" });
+});
+test("gitOnlyDrift tells an identity-only change apart from other edits", () => {
+    const identity = gitIdentityEnv("John Doe", "john.doe@git.example");
+    // No drift at all qualifies (there is nothing else to lose by committing).
+    assert.equal(gitOnlyDrift(identity, identity), true);
+    // Changing or removing the identity alone is git-only.
+    assert.equal(gitOnlyDrift(identity, setGitIdentity(identity, "New", "new@example.com")), true);
+    assert.equal(gitOnlyDrift(identity, setGitIdentity(identity, "", "")), true);
+    // Any other default drift means the Save button must stay in charge.
+    assert.equal(gitOnlyDrift(identity, { ...identity, KEEP: "1" }), false);
+    assert.equal(gitOnlyDrift({ KEEP: "1" }, { KEEP: "2" }), false);
+    // Removing a non-identity key, or an identity key drifting in the server map
+    // while another edit exists, both count as a real diff.
+    assert.equal(gitOnlyDrift({ KEEP: "1", ...identity }, identity), false);
+});
+test("commitIdentityAction applies the popup result without losing edits", () => {
+    const saved = gitIdentityEnv("John Doe", "john.doe@git.example");
+    const changed = setGitIdentity(saved, "New", "new@example.com");
+    // The popup restores the saved identity while the draft still holds the
+    // changed one: the pending identity edit is discarded, not kept (regression:
+    // the old code returned early and left the changed identity in the draft).
+    assert.equal(commitIdentityAction(saved, changed, saved), "discard");
+    // No drift at all and an unchanged popup is a no-op discard too.
+    assert.equal(commitIdentityAction(saved, saved, saved), "discard");
+    // An identity-only change commits straight: nothing else can be lost.
+    assert.equal(commitIdentityAction(saved, changed, changed), "save");
+    assert.equal(commitIdentityAction(saved, saved, changed), "save");
+    // Clearing the identity alone is also git-only.
+    assert.equal(commitIdentityAction(saved, changed, {}), "save");
+    // Another pending default keeps the result in the draft, whatever the popup
+    // does to the identity: change, restore, or clear.
+    const withKeep = { ...saved, KEEP: "1" };
+    assert.equal(commitIdentityAction(saved, withKeep, { ...withKeep, ...changed }), "draft");
+    assert.equal(commitIdentityAction(saved, withKeep, withKeep), "draft");
+    assert.equal(commitIdentityAction(saved, withKeep, { KEEP: "1" }), "draft");
+});