@exagone313/dsh-podman 0.2.0-rc.3 → 0.2.0

package/dist/card-route.js

@@ -6,11 +6,26 @@
 // request, so neither the snapshot nor the commands touch the persisted
 // settings document.
 import { CARD_PATH, } from "./client/card-protocol.js";
-import { renderCacheCleanNotice, resolveReasonLocale } from "./approval-reasons.js";
-import { defaultMountMode, mountKindToProto, mountModeToProto } from "./mount-enums.js";
+import { renderCacheCleanNotice, renderDefaultEnvSyncNotice, resolveReasonLocale, } from "./approval-reasons.js";
+import { mergeDefaultEnv, missingDefaultEnv } from "./container-env.js";
+import { defaultMountMode, mountKindToProto, mountModeToProto, } from "./mount-enums.js";
+import { mountInputToProto, validateMountInput } from "./mount-input.js";
 import { unaryGuest } from "./guest-rpc.js";
 import { workspaceSlug } from "./workspace-binding.js";
 import { GIT_COMMIT, VERSION } from "./generated/version.js";
+import { versionState as pluginVersionState } from "./version-compat.js";
+import { dshVersion } from "./dsh-version.js";
+// readOrchestratorVersion asks the orchestrator for its version, or returns ""
+// when the call fails (an orchestrator predating the handshake).
+async function readOrchestratorVersion(resolver) {
+    try {
+        const response = await resolver.control("getVersion", {});
+        return String(response?.version ?? "");
+    }
+    catch {
+        return "";
+    }
+}
 // The cache clean modes the settings card can request, mapped to the control
 // plane's enum names.
 const CACHE_CLEAN_MODES = {
@@ -25,17 +40,32 @@ function cacheCleanModeToProto(mode) {
         throw new Error(`unknown cache clean mode: ${mode}`);
     return proto;
 }
-function mountInputToProto(mount) {
-    const kind = mountKindToProto(mount.kind || undefined);
-    const mode = mountModeToProto(mount.mode || defaultMountMode(mount.kind || undefined));
-    const result = { projectName: mount.project ?? "", kind, mode };
-    if (kind !== "MOUNT_KIND_PROJECT" && mount.destination)
-        result.destination = mount.destination;
-    if (mount.volume)
-        result.volume = mount.volume;
-    if (mount.secret)
-        result.secret = mount.secret;
-    return result;
+// containerMountView and imageView rebuild the snapshot's nested objects from
+// an explicit allow-list, so a field added to the proto later cannot reach the
+// browser just because it exists on the wire (see AGENTS.md "Security").
+function containerMountView(mount) {
+    return {
+        projectName: stringField(mount?.projectName),
+        destination: stringField(mount?.destination),
+        kind: stringField(mount?.kind),
+        mode: stringField(mount?.mode),
+        volume: stringField(mount?.volume),
+        secret: stringField(mount?.secret),
+    };
+}
+function imageView(image) {
+    return {
+        imageId: stringField(image?.imageId),
+        parent: stringField(image?.parent),
+        packages: Array.isArray(image?.packages) ? image.packages.map(String) : [],
+        imageTag: stringField(image?.imageTag),
+        builtAt: stringField(image?.builtAt),
+        isBase: Boolean(image?.isBase),
+        status: stringField(image?.status),
+        primitive: stringField(image?.primitive),
+        packageManager: stringField(image?.packageManager),
+        basePublic: Boolean(image?.basePublic),
+    };
 }
 function orchestratorWorkspaceViews(raw) {
     return (raw ?? []).map((workspace) => ({
@@ -63,12 +93,15 @@ function dshWorkspaceViews(registry, projectsRoot) {
             : path;
         return {
             workspaceSlug: workspaceSlug(workspace.id),
-            projectName: projectName || String(workspace.title ?? "") || String(workspace.id ?? ""),
+            projectName: projectName || String(workspace.title ?? "") ||
+                String(workspace.id ?? ""),
             containerName: "",
             imageId: "",
             status: "",
             createdAt: workspace.createdAt ?? "",
-            mounts: projectName !== "" ? [{ projectName, mode: "MOUNT_MODE_READ_WRITE" }] : [],
+            mounts: projectName !== ""
+                ? [{ projectName, mode: "MOUNT_MODE_READ_WRITE" }]
+                : [],
         };
     });
 }
@@ -99,17 +132,49 @@ function dshWorkspaceCwd(registry, slug) {
 }
 /** Build the live snapshot the card renders. */
 export async function cardSnapshot(resolver, workspaceRegistry) {
-    const [containers, images, workspaces, volumes, secrets, caches] = await Promise.all([
-        resolver.control("listContainers", {}),
-        resolver.control("listImages", {}),
-        resolver.control("listWorkspaces", {}),
-        resolver.control("listVolumes", {}),
-        resolver.control("listSecrets", {}),
-        resolver.control("listCaches", {}),
-    ]);
+    // The handshake RPC is exempt from the orchestrator's version check, so it
+    // succeeds even when the rest is refused; an older orchestrator that has no
+    // GetVersion yet leaves the version unknown.
+    const orchestratorVersion = await readOrchestratorVersion(resolver);
+    let listings;
+    try {
+        listings = await Promise.all([
+            resolver.control("listContainers", {}),
+            resolver.control("listImages", {}),
+            resolver.control("listWorkspaces", {}),
+            resolver.control("listVolumes", {}),
+            resolver.control("listSecrets", {}),
+            resolver.control("listCaches", {}),
+        ]);
+    }
+    catch (error) {
+        // An incompatible plugin is refused before any handler runs, so the card
+        // reports the mismatch instead of an unexplained empty snapshot.
+        if (error?.code !== "FailedPrecondition") {
+            throw error;
+        }
+        return {
+            version: VERSION,
+            commit: GIT_COMMIT,
+            dshVersion: dshVersion(),
+            orchestratorVersion,
+            versionState: "major-mismatch",
+            projectsRoot: resolver.getConfig().projectsRoot,
+            workspaces: [],
+            containers: [],
+            images: [],
+            volumes: [],
+            secrets: [],
+            caches: [],
+        };
+    }
+    const [containers, images, workspaces, volumes, secrets, caches] = listings;
     return {
         version: VERSION,
         commit: GIT_COMMIT,
+        dshVersion: dshVersion(),
+        orchestratorVersion,
+        versionState: pluginVersionState(VERSION, orchestratorVersion),
         projectsRoot: resolver.getConfig().projectsRoot,
         workspaces: mergeWorkspaceViews(dshWorkspaceViews(workspaceRegistry, resolver.getConfig().projectsRoot), orchestratorWorkspaceViews(workspaces.workspaces)),
         containers: (containers.containers ?? []).map((container) => ({
@@ -118,12 +183,12 @@ export async function cardSnapshot(resolver, workspaceRegistry) {
             imageId: container.imageId ?? "",
             status: container.status ?? "",
             createdAt: container.createdAt ?? "",
-            mounts: container.mounts ?? [],
+            mounts: (container.mounts ?? []).map(containerMountView),
             paths: container.paths ?? [],
             env: container.env ?? {},
             secretEnv: container.secretEnv ?? {},
         })),
-        images: images.images ?? [],
+        images: (images.images ?? []).map(imageView),
         volumes: (volumes.volumes ?? []).map((volume) => ({
             name: volume.name ?? "",
         })),
@@ -143,7 +208,9 @@ export async function cardSnapshot(resolver, workspaceRegistry) {
  * Run one card command, returning the notice to show (usually empty). `ctx` is
  * the settings-injected context, read only for the session locale.
  */
-export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
+export async function runCommand(_ctx, resolver, workspaceRegistry, raw, 
+// The live UI locale, read per notice; absent in tests, which render English.
+readLocale) {
     const command = normalizeCommand(raw);
     let notice = "";
     switch (command.op) {
@@ -152,13 +219,18 @@ export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
                 workspaceSlug: command.workspace,
                 imageId: command.image === "" ? undefined : command.image,
             };
-            const mounts = command.mounts.map(mountInputToProto);
+            const projectsRoot = resolver.getConfig().projectsRoot;
+            const mounts = command.mounts.map((mount) => mountInputToProto(mount, projectsRoot));
             if (mounts.length > 0)
                 payload.mounts = mounts;
-            if (Object.keys(command.env).length > 0)
-                payload.env = command.env;
-            if (Object.keys(command.secretEnvMap).length > 0) {
-                payload.secretEnv = command.secretEnvMap;
+            // The card's create is a creation path: seed the default environment
+            // under whatever the modal collected. A later recreate is authoritative,
+            // which is how a seeded value is removed again.
+            const env = mergeDefaultEnv(resolver.getConfig().containerEnv, command.env);
+            if (Object.keys(env).length > 0)
+                payload.env = env;
+            if (Object.keys(command.secretEnv).length > 0) {
+                payload.secretEnv = command.secretEnv;
             }
             if (command.paths.length > 0)
                 payload.paths = [...command.paths];
@@ -180,6 +252,7 @@ export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
             const m = command.mount;
             if (m === null)
                 break;
+            validateMountInput(m, resolver.getConfig().projectsRoot);
             const kind = mountKindToProto(m.kind || undefined);
             const mode = mountModeToProto(m.mode || defaultMountMode(m.kind || undefined));
             const request = {
@@ -238,6 +311,9 @@ export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
             const m = command.mount;
             if (m === null)
                 break;
+            // An update sets a mode, so a secret mount must not be made read-write
+            // here either.
+            validateMountInput(m, resolver.getConfig().projectsRoot);
             const kind = mountKindToProto(m.kind || undefined);
             const request = {
                 workspaceSlug: command.workspace,
@@ -277,6 +353,7 @@ export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
         case "remove":
             await resolver.control("removeContainer", {
                 workspaceSlug: command.workspace,
+                ...(command.container !== "" ? { container: command.container } : {}),
             });
             break;
         case "workspace_remove":
@@ -287,6 +364,7 @@ export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
         case "recreate":
             await resolver.control("recreateContainer", {
                 workspaceSlug: command.workspace,
+                ...(command.container !== "" ? { container: command.container } : {}),
                 imageId: command.image === "" ? undefined : command.image,
                 ...(Object.keys(command.env).length > 0 ? { env: command.env } : {}),
             });
@@ -326,7 +404,7 @@ export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
             await resolver.control("addContainerSecret", {
                 workspaceSlug: command.workspace,
                 container: command.container || "default",
-                env: command.secretEnv,
+                env: command.secretEnvName,
                 secret: command.secret,
             });
             break;
@@ -334,7 +412,7 @@ export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
             await resolver.control("removeContainerSecret", {
                 workspaceSlug: command.workspace,
                 container: command.container || "default",
-                env: command.secretEnv,
+                env: command.secretEnvName,
             });
             break;
         case "image_build":
@@ -350,11 +428,44 @@ export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
         case "image_base_pull":
             await resolver.control("pullBaseImage", { name: command.workspace });
             break;
+        case "default_env_sync": {
+            // Add the default environment to containers that already exist. Only the
+            // keys a container is missing are added, so an explicit value is never
+            // overwritten, and a stopped container is left for its next start (which
+            // seeds the defaults). A recreate applies the merged map.
+            const defaults = resolver.getConfig().containerEnv ?? {};
+            if (Object.keys(defaults).length === 0)
+                break;
+            const listings = await resolver.control("listContainers", {});
+            let applied = 0;
+            let skipped = 0;
+            for (const row of listings.containers ?? []) {
+                if (command.workspace !== "" && row.workspaceSlug !== command.workspace) {
+                    continue;
+                }
+                const current = (row.env ?? {});
+                const missing = missingDefaultEnv(defaults, current);
+                if (Object.keys(missing).length === 0)
+                    continue;
+                if (row.status !== "running") {
+                    skipped++;
+                    continue;
+                }
+                await resolver.control("recreateContainer", {
+                    workspaceSlug: row.workspaceSlug,
+                    container: row.containerName,
+                    env: mergeDefaultEnv(defaults, current),
+                });
+                applied++;
+            }
+            notice = renderDefaultEnvSyncNotice(resolveReasonLocale(readLocale?.()), applied, skipped);
+            break;
+        }
         case "cache_clean": {
             const result = (await resolver.control("cleanCaches", {
                 mode: cacheCleanModeToProto(command.cacheMode),
             }));
-            notice = renderCacheCleanNotice(resolveReasonLocale(ctx?.settings), Number(result.removedFiles ?? 0));
+            notice = renderCacheCleanNotice(resolveReasonLocale(readLocale?.()), Number(result.removedFiles ?? 0));
             break;
         }
         default:
@@ -372,8 +483,9 @@ function stringField(value, fallback = "") {
     return typeof value === "string" ? value : fallback;
 }
 function stringMap(value) {
-    if (typeof value !== "object" || value === null || Array.isArray(value))
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
         return {};
+    }
     const result = {};
     for (const [key, item] of Object.entries(value)) {
         result[key] = String(item);
@@ -416,16 +528,16 @@ function normalizeCommand(raw) {
         env: stringMap(raw.env),
         container: stringField(raw.container),
         secret: stringField(raw.secret),
-        secretEnv: stringField(raw.secretEnv),
+        secretEnvName: stringField(raw.secretEnvName),
         length: typeof raw.length === "number" ? raw.length : 0,
         charset: stringField(raw.charset),
         packages: Array.isArray(raw.packages) ? raw.packages.map(String) : [],
-        secretEnvMap: stringMap(raw.secretEnvMap),
+        secretEnv: stringMap(raw.secretEnv),
         cacheMode: stringField(raw.cacheMode),
         mount: mountField(raw.mount),
     };
 }
-async function handleCardRequest(request, ctx, resolver, workspaceRegistry) {
+async function handleCardRequest(request, ctx, resolver, workspaceRegistry, readLocale) {
     if (request.method === "GET") {
         try {
             return jsonResponse(200, await cardSnapshot(resolver, workspaceRegistry));
@@ -451,7 +563,7 @@ async function handleCardRequest(request, ctx, resolver, workspaceRegistry) {
         return jsonResponse(400, { error: "a command is required" });
     }
     try {
-        const notice = await runCommand(ctx, resolver, workspaceRegistry, command);
+        const notice = await runCommand(ctx, resolver, workspaceRegistry, command, readLocale);
         const result = notice === "" ? {} : { notice };
         return jsonResponse(200, result);
     }
@@ -466,13 +578,13 @@ async function handleCardRequest(request, ctx, resolver, workspaceRegistry) {
  * harness API path, so the carrier applies its Host/Origin fence and browser
  * authentication before the handler runs.
  */
-export function registerCardRoute(ctx, resolver, workspaceRegistry) {
-    ctx.inject(["connection", "settings"], (connectionCtx) => {
+export function registerCardRoute(ctx, resolver, workspaceRegistry, readLocale) {
+    ctx.inject(["connection"], (connectionCtx) => {
         connectionCtx.connection.fetch.register({
             path: CARD_PATH,
             methods: ["GET", "POST"],
             requestBody: "buffered",
-            fetch: (request) => handleCardRequest(request, connectionCtx, resolver, workspaceRegistry),
+            fetch: (request) => handleCardRequest(request, connectionCtx, resolver, workspaceRegistry, readLocale),
         });
     });
 }

package/dist/card-route.test.js

@@ -5,7 +5,6 @@ import { test } from "node:test";
 import { strict as assert } from "node:assert";
 import { CARD_PATH } from "./client/card-protocol.js";
 import { registerCardRoute } from "./card-route.js";
-import { installContainerPreferences } from "./preferences.js";
 function fakeResolver() {
     const calls = [];
     const resolver = {
@@ -17,8 +16,11 @@ function fakeResolver() {
         setConfig: () => { },
         async control(method, request) {
             calls.push([method, request]);
-            if (method === "listContainers")
+            if (method === "getVersion")
+                return { version: "9.9.9", commit: "abc" };
+            if (method === "listContainers") {
                 return { containers: [{ containerName: "c1" }] };
+            }
             if (method === "listImages")
                 return { images: [{ imageId: "img1" }] };
             if (method === "listWorkspaces")
@@ -27,8 +29,9 @@ function fakeResolver() {
                 return { volumes: [{ name: "data" }] };
             if (method === "listSecrets")
                 return { secrets: [{ name: "s1" }] };
-            if (method === "listCaches")
+            if (method === "listCaches") {
                 return { caches: [{ manager: "pacman", files: 1, bytes: "1024" }] };
+            }
             if (method === "cleanCaches")
                 return { removedFiles: 2 };
             if (method === "removeContainer")
@@ -42,7 +45,7 @@ function fakeRouteContext() {
     const routes = [];
     const ctx = {
         inject(deps, callback) {
-            assert.deepEqual(deps, ["connection", "settings"]);
+            assert.deepEqual(deps, ["connection"]);
             callback({
                 connection: {
                     fetch: {
@@ -57,10 +60,6 @@ function fakeRouteContext() {
                         },
                     },
                 },
-                settings: {
-                    register: () => ({ watch: () => () => { } }),
-                    get: () => undefined,
-                },
             });
         },
     };
@@ -92,7 +91,38 @@ test("the card route serves the live snapshot on GET", async () => {
     assert.deepEqual(snapshot.volumes, [{ name: "data" }]);
     assert.deepEqual(snapshot.secrets, [{ name: "s1" }]);
     assert.equal(snapshot.caches[0].bytes, 1024);
-    assert.deepEqual(calls.map(([method]) => method), ["listContainers", "listImages", "listWorkspaces", "listVolumes", "listSecrets", "listCaches"]);
+    assert.deepEqual(calls.map(([method]) => method), [
+        "getVersion",
+        "listContainers",
+        "listImages",
+        "listWorkspaces",
+        "listVolumes",
+        "listSecrets",
+        "listCaches",
+    ]);
+    assert.equal(typeof snapshot.dshVersion, "string");
+    assert.equal(snapshot.orchestratorVersion, "9.9.9");
+    assert.equal(snapshot.versionState, "major-mismatch", "a differing major is surfaced on the card");
+});
+test("a refused control call reports the version mismatch instead of an empty snapshot", async () => {
+    const { resolver } = fakeResolver();
+    const refusal = new Error("plugin is incompatible");
+    refusal.code = "FailedPrecondition";
+    resolver.control = async (method) => {
+        if (method === "getVersion")
+            return { version: "9.9.9", commit: "abc" };
+        throw refusal;
+    };
+    const { ctx, routes } = fakeRouteContext();
+    registerCardRoute(ctx, resolver);
+    const response = await routes[0].fetch(cardRequest());
+    assert.equal(response.status, 200);
+    const snapshot = (await response.json());
+    assert.equal(typeof snapshot.dshVersion, "string");
+    assert.equal(snapshot.orchestratorVersion, "9.9.9");
+    assert.equal(snapshot.versionState, "major-mismatch");
+    assert.deepEqual(snapshot.containers, []);
+    assert.deepEqual(snapshot.workspaces, []);
 });
 test("the card route runs one command per POST and returns its notice", async () => {
     const { resolver, calls } = fakeResolver();
@@ -104,9 +134,51 @@ test("the card route runs one command per POST and returns its notice", async ()
     }));
     assert.equal(remove.status, 200);
     assert.deepEqual(await remove.json(), {});
-    assert.deepEqual(calls.find(([method]) => method === "removeContainer")?.[1], {
+    // A command that names no container keeps the orchestrator's default; one that
+    // names a container must reach it, or a row's Remove would hit another one.
+    const removeNamed = await routes[0].fetch(cardRequest({
+        method: "POST",
+        body: JSON.stringify({
+            command: { op: "remove", workspace: "w1", container: "foo" },
+        }),
+    }));
+    assert.equal(removeNamed.status, 200);
+    const removeCalls = calls.filter(([method]) => method === "removeContainer");
+    assert.deepEqual(removeCalls[0]?.[1], { workspaceSlug: "w1" });
+    assert.deepEqual(removeCalls[1]?.[1], {
+        workspaceSlug: "w1",
+        container: "foo",
+    });
+    const recreate = await routes[0].fetch(cardRequest({
+        method: "POST",
+        body: JSON.stringify({
+            command: {
+                op: "recreate",
+                workspace: "w1",
+                container: "foo",
+                image: "img1",
+            },
+        }),
+    }));
+    assert.equal(recreate.status, 200);
+    assert.deepEqual(calls.find(([method]) => method === "recreateContainer")?.[1], {
         workspaceSlug: "w1",
+        container: "foo",
+        imageId: "img1",
     });
+    const detach = await routes[0].fetch(cardRequest({
+        method: "POST",
+        body: JSON.stringify({
+            command: {
+                op: "container_secret_remove",
+                workspace: "w1",
+                container: "foo",
+                secretEnvName: "TOKEN",
+            },
+        }),
+    }));
+    assert.equal(detach.status, 200);
+    assert.deepEqual(calls.find(([method]) => method === "removeContainerSecret")?.[1], { workspaceSlug: "w1", container: "foo", env: "TOKEN" });
     const clean = await routes[0].fetch(cardRequest({
         method: "POST",
         body: JSON.stringify({ command: { op: "cache_clean", cacheMode: "all" } }),
@@ -145,37 +217,7 @@ test("the card route reports a failed command as an error", async () => {
         body: JSON.stringify({ command: { op: "remove", workspace: "w1" } }),
     }));
     assert.equal(response.status, 500);
-    assert.deepEqual(await response.json(), { error: "control plane unavailable" });
-});
-test("installContainerPreferences seeds the base and syncs the resolver config", () => {
-    let base;
-    let watcher;
-    const ctx = {
-        inject(deps, callback) {
-            assert.deepEqual(deps, ["settings"]);
-            callback({
-                settings: {
-                    register(_ns, _schema, options) {
-                        base = options.base;
-                        return {
-                            watch(callback) {
-                                watcher = callback;
-                                return () => { };
-                            },
-                        };
-                    },
-                },
-            });
-        },
-    };
-    const configs = [];
-    const resolver = {
-        getConfig: () => ({ defaultImage: "archlinux", socketsRoot: "/run/dsh-podman" }),
-        setConfig: (patch) => configs.push(patch),
-    };
-    installContainerPreferences(ctx, resolver);
-    assert.deepEqual(base, { defaultImage: "archlinux", socketsRoot: "/run/dsh-podman" });
-    assert.ok(watcher !== undefined);
-    watcher({ defaultImage: "ubuntu", socketsRoot: "/run/other" });
-    assert.deepEqual(configs, [{ defaultImage: "ubuntu", socketsRoot: "/run/other" }]);
+    assert.deepEqual(await response.json(), {
+        error: "control plane unavailable",
+    });
 });

package/dist/card-test-support.js

@@ -6,8 +6,6 @@
 // `runCommand` and folds the real `cardSnapshot` back into the fake scope, so
 // the command tests stay focused on the command-to-control mapping. The HTTP
 // layer itself is covered by card-route.test.ts.
-import { strict as assert } from "node:assert";
-import { CONTAINER_NS, settingsSchema } from "./settings-schema.js";
 import { cardSnapshot, runCommand } from "./card-route.js";
 export function fakeScope(initial) {
     const scope = {
@@ -30,26 +28,14 @@ export function fakeScope(initial) {
     return scope;
 }
 export function fakeContext(scope) {
-    return {
-        inject(deps, callback) {
-            assert.deepEqual(deps, ["settings"]);
-            callback({
-                settings: {
-                    register() {
-                        return scope;
-                    },
-                    get() {
-                        return undefined;
-                    },
-                },
-            });
-        },
-    };
+    // The host half no longer registers a settings namespace: the card's
+    // preferences are volatile plugin-config fields, so the fake document is
+    // handed to the driver directly.
+    return { fakeScope: scope };
 }
 export function baseValue() {
     return {
         defaultImage: "archlinux",
-        socketsRoot: "/run/dsh-podman",
         uiLocale: "",
         notice: "",
         command: null,
@@ -61,62 +47,49 @@ export function baseValue() {
         caches: [],
     };
 }
-// installCardCommandDriver wires a fake settings scope to the real command
+// installCardCommandDriver wires a fake settings document to the real command
 // runner and snapshot builder, standing in for the browser transport: it
 // mirrors what the card does per request — run the command, then refresh the
 // live snapshot and record the notice.
 export function installCardCommandDriver(ctx, resolver, registry) {
-    let installed = Promise.resolve();
-    ctx.inject(["settings"], (sctx) => {
-        const scope = sctx.settings.register(CONTAINER_NS, settingsSchema, {
-            base: {
-                defaultImage: resolver.getConfig().defaultImage,
-                socketsRoot: resolver.getConfig().socketsRoot,
-            },
-        });
-        const refresh = async (notice = "") => {
-            let view = {};
+    const scope = ctx.fakeScope;
+    const refresh = async (notice = "") => {
+        let view = {};
+        try {
+            const snapshot = await cardSnapshot(resolver, registry);
+            view = {
+                workspaces: snapshot.workspaces,
+                containers: snapshot.containers,
+                images: snapshot.images,
+                volumes: snapshot.volumes,
+                secrets: snapshot.secrets,
+                caches: snapshot.caches,
+            };
+        }
+        catch {
+            // Command tests do not always stub every list call.
+        }
+        await scope.update({ ...view, notice });
+    };
+    scope.watch((next) => {
+        const command = next.command;
+        if (command === null || command === undefined)
+            return;
+        void (async () => {
+            // Clear the command before running it, so the refresh below cannot
+            // re-deliver it.
+            await scope.update({ command: null });
+            let notice = "";
             try {
-                const snapshot = await cardSnapshot(resolver, registry);
-                view = {
-                    workspaces: snapshot.workspaces,
-                    containers: snapshot.containers,
-                    images: snapshot.images,
-                    volumes: snapshot.volumes,
-                    secrets: snapshot.secrets,
-                    caches: snapshot.caches,
-                };
+                notice = await runCommand(ctx, resolver, registry, command);
             }
-            catch {
-                // Command tests do not always stub every list call.
+            catch (error) {
+                notice = error instanceof Error ? error.message : String(error);
             }
-            await scope.update({ ...view, notice });
-        };
-        scope.watch((next) => {
-            resolver.setConfig({
-                defaultImage: next.defaultImage,
-                socketsRoot: next.socketsRoot,
-            });
-            const command = next.command;
-            if (command === null || command === undefined)
-                return;
-            void (async () => {
-                // Clear the command before running it, so the refresh below cannot
-                // re-deliver it.
-                await scope.update({ command: null });
-                let notice = "";
-                try {
-                    notice = await runCommand(sctx, resolver, registry, command);
-                }
-                catch (error) {
-                    notice = error instanceof Error ? error.message : String(error);
-                }
-                await refresh(notice);
-            })();
-        });
-        installed = refresh();
+            await refresh(notice);
+        })();
     });
-    return installed;
+    return refresh();
 }
 export async function installedMountScope() {
     const scope = fakeScope(baseValue());