@exagone313/dsh-podman 0.2.0-rc.3 → 0.2.0

package/dist/settings-create.test.js

@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: MIT
 import { test } from "node:test";
 import { strict as assert } from "node:assert";
-import { fakeScope, fakeContext, baseValue } from "./card-test-support.js";
+import { baseValue, fakeContext, fakeScope } from "./card-test-support.js";
 import { installCardCommandDriver } from "./card-test-support.js";
 test("create command sends PATH additions", async () => {
     const scope = fakeScope(baseValue());
@@ -34,7 +34,7 @@ test("create command sends PATH additions", async () => {
             paths: ["/opt/bin"],
             env: {},
             container: "",
-            secretEnvMap: {},
+            secretEnv: {},
             mount: null,
         },
     });
@@ -73,7 +73,7 @@ test("create command sends PATH additions", async () => {
             mounts: [],
             paths: ["/opt/bin", "/usr/local/bin"],
             env: {},
-            secretEnvMap: {},
+            secretEnv: {},
             mount: null,
         },
     });
@@ -137,7 +137,14 @@ test("secret_create command drives createSecret with the name", async () => {
     };
     await installCardCommandDriver(fakeContext(scope), resolver);
     await scope.update({
-        command: { op: "secret_create", workspace: "db-pass", image: "", at: 6, mounts: [], value: "" },
+        command: {
+            op: "secret_create",
+            workspace: "db-pass",
+            image: "",
+            at: 6,
+            mounts: [],
+            value: "",
+        },
     });
     await new Promise((resolve) => setImmediate(resolve));
     const createCall = calls.find(([method]) => method === "createSecret");
@@ -167,7 +174,13 @@ test("secret_create command drives createSecret with length when provided", asyn
     };
     await installCardCommandDriver(fakeContext(scope), resolver);
     await scope.update({
-        command: { op: "secret_create", workspace: "s", image: "", at: 11, length: 48 },
+        command: {
+            op: "secret_create",
+            workspace: "s",
+            image: "",
+            at: 11,
+            length: 48,
+        },
     });
     await new Promise((resolve) => setImmediate(resolve));
     const createCall = calls.find(([method]) => method === "createSecret");
@@ -227,11 +240,20 @@ test("secret_create command drives createSecret with charset when provided", asy
     };
     await installCardCommandDriver(fakeContext(scope), resolver);
     await scope.update({
-        command: { op: "secret_create", workspace: "tok", length: 48, charset: "hex" },
+        command: {
+            op: "secret_create",
+            workspace: "tok",
+            length: 48,
+            charset: "hex",
+        },
     });
     await new Promise((resolve) => setImmediate(resolve));
     const createCall = calls.find(([method]) => method === "createSecret");
-    assert.deepEqual(createCall?.[1], { name: "tok", length: 48, charset: "hex" });
+    assert.deepEqual(createCall?.[1], {
+        name: "tok",
+        length: 48,
+        charset: "hex",
+    });
     assert.equal(scope.value.command, null);
 });
 test("recreate command drives recreateContainer with env", async () => {
@@ -297,7 +319,7 @@ test("create command with a container name routes to startContainer", async () =
             at: 1,
             mounts: [],
             env: {},
-            secretEnvMap: {},
+            secretEnv: {},
             mount: null,
         },
     });
@@ -339,7 +361,7 @@ test("create command sends secret env", async () => {
             mounts: [],
             env: {},
             container: "",
-            secretEnvMap: { VALKEY_PASSWORD: "valkey-tls" },
+            secretEnv: { VALKEY_PASSWORD: "valkey-tls" },
             mount: null,
         },
     });
@@ -379,7 +401,7 @@ test("create command sends secret env", async () => {
             mounts: [],
             env: {},
             container: "",
-            secretEnvMap: {},
+            secretEnv: {},
             mount: null,
         },
     });

package/dist/settings-default-env.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/settings-default-env.test.js

@@ -0,0 +1,175 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+// The default container environment through the settings card: seeding on
+// creation, authoritative recreates, and the synchronisation into existing
+// containers.
+import { test } from "node:test";
+import { strict as assert } from "node:assert";
+import { baseValue, fakeContext, fakeScope, installCardCommandDriver, } from "./card-test-support.js";
+const DEFAULTS = {
+    GIT_AUTHOR_NAME: "John Doe",
+    GIT_AUTHOR_EMAIL: "john.doe@git.example",
+};
+function driver(containerEnv, containers = []) {
+    const scope = fakeScope(baseValue());
+    const calls = [];
+    const resolver = {
+        getConfig: () => (containerEnv === undefined ? {} : { containerEnv }),
+        setConfig: () => { },
+        async control(method, request) {
+            calls.push([method, request]);
+            if (method === "listContainers")
+                return { containers };
+            if (method === "listImages")
+                return { images: [] };
+            if (method === "listWorkspaces")
+                return { workspaces: [] };
+            return {};
+        },
+    };
+    return { scope, calls, resolver };
+}
+const settle = () => new Promise((resolve) => setImmediate(resolve));
+test("create seeds the default environment into a new workspace", async () => {
+    const { scope, calls, resolver } = driver(DEFAULTS);
+    await installCardCommandDriver(fakeContext(scope), resolver);
+    await scope.update({
+        command: {
+            op: "create",
+            workspace: "w1",
+            projectName: "team",
+            image: "img1",
+            mounts: [],
+            env: { EXTRA: "1" },
+            container: "",
+        },
+    });
+    await settle();
+    const create = calls.find(([method]) => method === "createWorkspace");
+    assert.deepEqual(create?.[1].env, { ...DEFAULTS, EXTRA: "1" });
+});
+test("create seeds the default environment into a new named container", async () => {
+    const { scope, calls, resolver } = driver(DEFAULTS);
+    await installCardCommandDriver(fakeContext(scope), resolver);
+    await scope.update({
+        command: {
+            op: "create",
+            workspace: "w1",
+            container: "web",
+            image: "img1",
+            mounts: [],
+            env: {},
+        },
+    });
+    await settle();
+    const start = calls.find(([method]) => method === "startContainer");
+    assert.deepEqual(start?.[1].env, DEFAULTS);
+    assert.equal(start?.[1].container, "web");
+});
+test("recreate is authoritative and does not re-seed the defaults", async () => {
+    const { scope, calls, resolver } = driver(DEFAULTS);
+    await installCardCommandDriver(fakeContext(scope), resolver);
+    await scope.update({
+        command: {
+            op: "recreate",
+            workspace: "w1",
+            image: "",
+            env: { EXTRA: "1" },
+        },
+    });
+    await settle();
+    const recreate = calls.find(([method]) => method === "recreateContainer");
+    assert.deepEqual(recreate?.[1].env, { EXTRA: "1" });
+});
+test("default_env_sync adds only missing keys to running containers", async () => {
+    const containers = [
+        {
+            workspaceSlug: "w1",
+            containerName: "default",
+            status: "running",
+            env: { EXTRA: "1" },
+        },
+        {
+            workspaceSlug: "w1",
+            containerName: "web",
+            status: "running",
+            env: { ...DEFAULTS },
+        },
+        {
+            workspaceSlug: "w2",
+            containerName: "default",
+            status: "stopped",
+            env: {},
+        },
+    ];
+    const { scope, calls, resolver } = driver(DEFAULTS, containers);
+    await installCardCommandDriver(fakeContext(scope), resolver);
+    await scope.update({ command: { op: "default_env_sync", workspace: "" } });
+    await settle();
+    const recreates = calls.filter(([method]) => method === "recreateContainer");
+    assert.deepEqual(recreates.map(([, request]) => request), [
+        {
+            workspaceSlug: "w1",
+            container: "default",
+            env: { ...DEFAULTS, EXTRA: "1" },
+        },
+    ], "only the incomplete running container is recreated, with existing values kept");
+    assert.equal(scope.value.notice, "applied the default environment to 1 container; 1 container stopped, to pick up on their next start");
+});
+test("default_env_sync honors a workspace filter", async () => {
+    const containers = [
+        {
+            workspaceSlug: "w1",
+            containerName: "default",
+            status: "running",
+            env: {},
+        },
+        {
+            workspaceSlug: "w2",
+            containerName: "default",
+            status: "running",
+            env: {},
+        },
+    ];
+    const { scope, calls, resolver } = driver(DEFAULTS, containers);
+    await installCardCommandDriver(fakeContext(scope), resolver);
+    await scope.update({ command: { op: "default_env_sync", workspace: "w2" } });
+    await settle();
+    const recreates = calls.filter(([method]) => method === "recreateContainer");
+    assert.deepEqual(recreates.map(([, request]) => request), [
+        { workspaceSlug: "w2", container: "default", env: DEFAULTS },
+    ]);
+});
+test("default_env_sync reports nothing to do when the defaults are absent", async () => {
+    const { scope, calls, resolver } = driver(undefined, [
+        {
+            workspaceSlug: "w1",
+            containerName: "default",
+            status: "running",
+            env: {},
+        },
+    ]);
+    await installCardCommandDriver(fakeContext(scope), resolver);
+    await calls.splice(0);
+    await scope.update({ command: { op: "default_env_sync", workspace: "" } });
+    await settle();
+    assert.equal(calls.some(([method]) => method === "recreateContainer"), false);
+    assert.equal(scope.value.notice, "");
+});
+test("default_env_sync reports an already-complete state", async () => {
+    const containers = [
+        {
+            workspaceSlug: "w1",
+            containerName: "default",
+            status: "running",
+            env: { ...DEFAULTS },
+        },
+    ];
+    const { scope, calls, resolver } = driver(DEFAULTS, containers);
+    await installCardCommandDriver(fakeContext(scope), resolver);
+    await scope.update({ command: { op: "default_env_sync", workspace: "" } });
+    await settle();
+    assert.equal(calls.some(([method]) => method === "recreateContainer"), false);
+    assert.equal(scope.value.notice, "the default environment is already applied to every running container");
+});

package/dist/settings-mounts.test.js

@@ -30,10 +30,17 @@ test("create command drives createWorkspace with mounts and image", async () =>
             projectName: "team",
             image: "img1",
             at: 1,
-            mounts: [{ kind: "project", project: "team", mode: "read_write", destination: "", volume: "", secret: "" }],
+            mounts: [{
+                    kind: "project",
+                    project: "team",
+                    mode: "read_write",
+                    destination: "",
+                    volume: "",
+                    secret: "",
+                }],
             env: {},
             container: "",
-            secretEnvMap: {},
+            secretEnv: {},
             mount: null,
         },
     });
@@ -43,7 +50,11 @@ test("create command drives createWorkspace with mounts and image", async () =>
         workspaceSlug: "w1",
         projectName: "team",
         imageId: "img1",
-        mounts: [{ projectName: "team", kind: "MOUNT_KIND_PROJECT", mode: "MOUNT_MODE_READ_WRITE" }],
+        mounts: [{
+                projectName: "team",
+                kind: "MOUNT_KIND_PROJECT",
+                mode: "MOUNT_MODE_READ_WRITE",
+            }],
     });
     assert.equal(scope.value.command, null);
 });
@@ -75,7 +86,7 @@ test("container_mount_add command drives addContainerMount for each kind", async
             mount: {
                 kind: "project",
                 project: "team/src",
-                destination: "/workspace/team",
+                destination: "",
                 mode: "read_only",
                 volume: "",
                 secret: "",
@@ -130,7 +141,7 @@ test("container_mount_add command drives addContainerMount for each kind", async
                 kind: "secret",
                 project: "",
                 destination: "/run/secrets/tls",
-                mode: "read_write",
+                mode: "read_only",
                 volume: "",
                 secret: "valkey-tls",
             },
@@ -330,6 +341,34 @@ test("container_mount_update command drives updateContainerMount", async () => {
     ]);
     assert.equal(scope.value.command, null);
 });
+test("container_mount_add command rejects a read-write secret mount", async () => {
+    const { scope, calls } = await installedMountScope();
+    await scope.update({
+        command: mountCommand("container_mount_add", {
+            kind: "secret",
+            secret: "valkey-tls",
+            destination: "/run/secrets/tls",
+            mode: "read_write",
+        }),
+    });
+    await new Promise((resolve) => setImmediate(resolve));
+    assert.equal(scope.value.notice, "secret mounts are read-only; omit mode or use read_only");
+    assert.equal(calls.some(([method]) => method === "addContainerMount"), false, "a rejected secret mount must not reach the orchestrator");
+});
+test("container_mount_update command rejects a secret mount", async () => {
+    const { scope, calls } = await installedMountScope();
+    await scope.update({
+        command: mountCommand("container_mount_update", {
+            kind: "secret",
+            secret: "valkey-tls",
+            destination: "/run/secrets/tls",
+            mode: "read_write",
+        }),
+    });
+    await new Promise((resolve) => setImmediate(resolve));
+    assert.equal(scope.value.notice, "secret mounts are read-only; omit mode or use read_only");
+    assert.equal(calls.some(([method]) => method === "updateContainerMount"), false, "a rejected secret mount must not reach the orchestrator");
+});
 test("container_mount_add command reports an unknown kind as a notice", async () => {
     const { scope, calls } = await installedMountScope();
     await scope.update({
@@ -389,7 +428,7 @@ test("create command reports an unknown mount kind as a notice", async () => {
                 }],
             env: {},
             container: "",
-            secretEnvMap: {},
+            secretEnv: {},
             mount: null,
         },
     });
@@ -416,7 +455,7 @@ test("create command reports an unknown mount mode as a notice", async () => {
                 }],
             env: {},
             container: "",
-            secretEnvMap: {},
+            secretEnv: {},
             mount: null,
         },
     });

package/dist/settings-schema.d.ts

@@ -1,14 +1,9 @@
+import { type Volatile } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
 export declare const CONTAINER_NS = "podman";
-export declare const settingsSchema: z<ContainerSettings>;
-export interface ContainerSettings {
-    defaultImage: string;
-    socketsRoot: string;
-    uiLocale: string;
-}
-export interface ContainerSettingsScope {
-    get(): ContainerSettings;
-    watch(callback: (next: ContainerSettings, prev: ContainerSettings) => void | Promise<void>): () => void;
-    update(patch: object): Promise<void>;
-    replace(section: object): Promise<void>;
+export interface Config {
+    defaultImage: Volatile<string>;
+    uiLocale: Volatile<string>;
+    containerEnv: Volatile<Record<string, string>>;
 }
+export declare const Config: z<Config>;

package/dist/settings-schema.js

@@ -3,12 +3,8 @@
 // SPDX-License-Identifier: MIT
 import z from "@deepseek-ai/schemastery";
 export const CONTAINER_NS = "podman";
-// Only real preferences live in the settings namespace, so the settings
-// document holds user choices and nothing derived. The live orchestrator state
-// and the card's commands travel over the card route instead (see
-// card-protocol.ts).
-export const settingsSchema = z.object({
-    defaultImage: z.string().default(""),
-    socketsRoot: z.string().default(""),
-    uiLocale: z.string().default(""),
+export const Config = z.object({
+    defaultImage: z.string().default("").volatile(),
+    uiLocale: z.string().default("").volatile(),
+    containerEnv: z.dict(z.string()).default({}).volatile(),
 });

package/dist/settings-schema.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/settings-schema.test.js

@@ -0,0 +1,35 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import test from "node:test";
+import assert from "node:assert/strict";
+import { Config } from "./settings-schema.js";
+import { WorkspaceResolver } from "./workspace-binding.js";
+test("every preference is a volatile field with an empty default", () => {
+    const config = Config({});
+    const expected = [
+        ["defaultImage", ""],
+        ["uiLocale", ""],
+        ["containerEnv", {}],
+    ];
+    for (const [field, value] of expected) {
+        assert.equal(typeof config[field].get, "function", `${field} must be volatile`);
+        assert.deepEqual(config[field].get(), value, `${field} must resolve its default`);
+    }
+    // The host serves the schema to the client config form: volatility must be
+    // declared on the schema, not only in the parsed value.
+    assert.match(JSON.stringify(Config.toJSON()), /"volatile":true/);
+});
+test("the resolver reads its config through the live reader", () => {
+    let defaultImage = "archlinux";
+    const resolver = new WorkspaceResolver(() => ({
+        socketsRoot: "/run/dsh-podman",
+        defaultImage,
+        projectsRoot: "/projects",
+        controlToken: "token",
+        containerEnv: {},
+    }), undefined);
+    assert.equal(resolver.getConfig().defaultImage, "archlinux");
+    defaultImage = "alpine";
+    assert.equal(resolver.getConfig().defaultImage, "alpine", "a volatile change must be visible without rebuilding the resolver");
+});

package/dist/settings-workspaces.test.js

@@ -18,6 +18,8 @@ test("refresh on install publishes containers, images and workspaces", async ()
         setConfig: () => { },
         async control(method, request) {
             calls.push([method, request]);
+            if (method === "getVersion")
+                return { version: "0.2.0", commit: "abc" };
             if (method === "listContainers") {
                 return { containers: [{ containerName: "c1", workspaceSlug: "w1" }] };
             }
@@ -25,7 +27,12 @@ test("refresh on install publishes containers, images and workspaces", async ()
                 return { images: [{ imageId: "img1" }] };
             }
             if (method === "listWorkspaces") {
-                return { workspaces: [{ workspaceSlug: "w1", mounts: [{ projectName: "team/app" }] }] };
+                return {
+                    workspaces: [{
+                            workspaceSlug: "w1",
+                            mounts: [{ projectName: "team/app" }],
+                        }],
+                };
             }
             if (method === "listVolumes") {
                 return { volumes: [{ name: "data" }, { name: "cache" }] };
@@ -38,7 +45,15 @@ test("refresh on install publishes containers, images and workspaces", async ()
     };
     await installCardCommandDriver(fakeContext(scope), resolver);
     await scope.update({}); // settle the queued async refresh
-    assert.deepEqual(calls.map(([method]) => method), ["listContainers", "listImages", "listWorkspaces", "listVolumes", "listSecrets", "listCaches"]);
+    assert.deepEqual(calls.map(([method]) => method), [
+        "getVersion",
+        "listContainers",
+        "listImages",
+        "listWorkspaces",
+        "listVolumes",
+        "listSecrets",
+        "listCaches",
+    ]);
     assert.equal(scope.value.containers.length, 1);
     assert.equal(scope.value.images.length, 1);
     const workspaces = scope.value.workspaces;
@@ -46,62 +61,9 @@ test("refresh on install publishes containers, images and workspaces", async ()
     assert.equal(workspaces[0].workspaceSlug, "w1");
     assert.equal(workspaces[0].projectName, "team/app");
     assert.deepEqual(scope.value.volumes, [{ name: "data" }, { name: "cache" }]);
-    assert.deepEqual(scope.value.secrets, [{ name: "db-pass" }, { name: "api-key" }]);
-});
-test("handle never writes projectsRoot into setConfig", async () => {
-    const scope = fakeScope(baseValue());
-    const setConfigCalls = [];
-    const resolver = {
-        getConfig: () => ({}),
-        setConfig: (patch) => setConfigCalls.push(patch),
-        async control(method) {
-            if (method === "listContainers")
-                return { containers: [] };
-            if (method === "listImages")
-                return { images: [] };
-            if (method === "listWorkspaces")
-                return { workspaces: [] };
-            return {};
-        },
-    };
-    await installCardCommandDriver(fakeContext(scope), resolver);
-    await scope.update({});
-    await new Promise((resolve) => setImmediate(resolve));
-    assert.ok(setConfigCalls.length > 0, "handle must write resolver config");
-    for (const patch of setConfigCalls) {
-        assert.ok(!Object.prototype.hasOwnProperty.call(patch, "projectsRoot"), "projectsRoot must not be written via setConfig");
-    }
-});
-test("settings seed the image and sockets root from the resolver config", async () => {
-    let registeredBase;
-    const scope = fakeScope(baseValue());
-    const context = {
-        inject(deps, callback) {
-            assert.deepEqual(deps, ["settings"]);
-            callback({
-                settings: {
-                    register(_namespace, _schema, options) {
-                        registeredBase = options?.base ?? {};
-                        return scope;
-                    },
-                },
-            });
-        },
-    };
-    const resolver = {
-        getConfig: () => ({
-            defaultImage: "archlinux",
-            socketsRoot: "/run/dsh-podman",
-            projectsRoot: "/projects",
-        }),
-        setConfig: () => { },
-        async control() {
-            return {};
-        },
-    };
-    await installCardCommandDriver(context, resolver);
-    assert.equal(registeredBase?.defaultImage, "archlinux");
-    assert.equal(registeredBase?.socketsRoot, "/run/dsh-podman");
+    assert.deepEqual(scope.value.secrets, [{ name: "db-pass" }, {
+            name: "api-key",
+        }]);
 });
 test("create command drives createWorkspace with env", async () => {
     const scope = fakeScope(baseValue());
@@ -131,7 +93,7 @@ test("create command drives createWorkspace with env", async () => {
             mounts: [],
             env: { A: "1", B: "2" },
             container: "",
-            secretEnvMap: {},
+            secretEnv: {},
             mount: null,
         },
     });
@@ -173,7 +135,7 @@ test("create command drives createWorkspace without env when empty", async () =>
             mounts: [],
             env: {},
             container: "",
-            secretEnvMap: {},
+            secretEnv: {},
             mount: null,
         },
     });
@@ -190,7 +152,12 @@ test("workspace list comes from the dsh registry even without orchestrator state
     const scope = fakeScope(baseValue());
     const registry = {
         list: () => [
-            { id: WORKSPACE_ID, path: "/projects/team/app", title: "app", createdAt: "2026-01-01T00:00:00Z" },
+            {
+                id: WORKSPACE_ID,
+                path: "/projects/team/app",
+                title: "app",
+                createdAt: "2026-01-01T00:00:00Z",
+            },
         ],
     };
     const resolver = {
@@ -225,7 +192,12 @@ test("dsh workspace layers orchestrator container info", async () => {
     const scope = fakeScope(baseValue());
     const registry = {
         list: () => [
-            { id: WORKSPACE_ID, path: "/projects/team/app", title: "app", createdAt: "2026-01-01T00:00:00Z" },
+            {
+                id: WORKSPACE_ID,
+                path: "/projects/team/app",
+                title: "app",
+                createdAt: "2026-01-01T00:00:00Z",
+            },
         ],
     };
     const resolver = {
@@ -247,7 +219,10 @@ test("dsh workspace layers orchestrator container info", async () => {
                             containerName: `dsh-podman-${WORKSPACE_ID}-default`,
                             imageId: "arch",
                             status: "running",
-                            mounts: [{ projectName: "team/app", mode: "MOUNT_MODE_READ_WRITE" }],
+                            mounts: [{
+                                    projectName: "team/app",
+                                    mode: "MOUNT_MODE_READ_WRITE",
+                                }],
                         }],
                 };
             }

package/dist/spill-store.d.ts

@@ -12,6 +12,7 @@ export interface SpillRef {
     bytes: number;
     retrievalHint: string;
 }
+export declare function sessionSegment(sessionId: unknown): string;
 export declare function createSpillStore(ctx: any, resolver: WorkspaceResolver): {
     saveText(input: SpillRequest): Promise<SpillRef>;
 };

package/dist/spill-store.js

@@ -17,10 +17,23 @@ function spillName(suggestedName) {
         .slice(0, 64);
     return `${randomUUID().replace(/-/g, "")}-${safe === "" ? "spill.txt" : safe}`;
 }
-// sessionSegment is the per-session directory name: session ids are UUIDs, but
-// a backend must never trust a caller-supplied segment in a path.
-function sessionSegment(sessionId) {
-    return sessionId.replace(/[^A-Za-z0-9._-]/g, "_");
+// sessionSegment is the per-session directory name. Session ids are not
+// guaranteed to be UUIDs (dsh mints `session-<n>`, `<id>-session-<uuid>`, and
+// `webhook-<uuid>`, and accepts a caller-supplied id), so the id is encoded
+// rather than trusted: a short readable prefix from a safe alphabet plus the
+// full id in hex — deterministic, collision-free, and never "." or "..".
+export function sessionSegment(sessionId) {
+    const id = String(sessionId ?? "");
+    const encoded = Buffer.from(id, "utf8").toString("hex");
+    const readable = id
+        .replace(/[^A-Za-z0-9_-]/g, "_")
+        .replace(/_{2,}/g, "_")
+        .replace(/^[_-]+/, "")
+        .slice(0, 24)
+        .replace(/[_-]+$/, "");
+    if (readable !== "")
+        return `${readable}-${encoded}`;
+    return encoded === "" ? "session" : encoded;
 }
 // createSpillStore backs `ctx.spillStore` with the session's container:
 // oversized tool results are written inside the guest, and the locator is the