@exagone313/dsh-podman 0.2.0-rc.4 → 0.3.0

package/dist/approval.test.js

@@ -3,11 +3,13 @@
 // SPDX-License-Identifier: MIT
 import test from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { readFileSync } from "node:fs";
 import { presetExec, sessionExec, testReadSession } from "./test-support.js";
-import { PODMAN_OPS_AGENT_CORDIS_YML, PODMAN_OPS_PRESET_YML, READ_ONLY_TOOLS, SANDBOX_ESCALATION_REASON_PREFIX, TOOLS, approvalDecision, ensurePodmanOpsPreset, isSandboxEscalation, preExecutePolicy, summarizeArgs, } from "./index.js";
+import { approvalDecision, isSandboxEscalation, preExecutePolicy, READ_ONLY_TOOLS, SANDBOX_ESCALATION_REASON_PREFIX, summarizeArgs, TOOLS, } from "./index.js";
+// The bundle patch that declares the Podman operator preset.
+function podmanOpsPatch() {
+    return readFileSync(new URL("../cordis.patch.yml", import.meta.url), "utf8");
+}
 test("isSandboxEscalation claims only the harness's sandbox escalation", () => {
     assert.equal(SANDBOX_ESCALATION_REASON_PREFIX, "escalate sandbox to ");
     assert.equal(isSandboxEscalation({
@@ -130,7 +132,19 @@ test("summarizeArgs renders the approval reason for each gated tool", () => {
     assert.equal(summarizeArgs("image_build", {
         imageId: "dev",
         parent: "archlinux",
-        packages: ["git", "curl", "tmux", "vim", "zsh", "openssh", "jq", "ripgrep", "make", "cc", "go"],
+        packages: [
+            "git",
+            "curl",
+            "tmux",
+            "vim",
+            "zsh",
+            "openssh",
+            "jq",
+            "ripgrep",
+            "make",
+            "cc",
+            "go",
+        ],
     }), 'Build image "dev" from "archlinux" with packages: git, curl, tmux, vim, zsh, openssh, jq, ripgrep, +3 more.');
     assert.equal(summarizeArgs("image_rebuild", { imageId: "valkey" }), 'Rebuild image "valkey".');
     assert.equal(summarizeArgs("image_rebuild_all", {}), "Rebuild all images.");
@@ -247,7 +261,12 @@ test("read-only permission allows get/list tools and denies the rest", async ()
         assert.equal(delegated, true, `${name} must be allowed under read-only`);
         assert.equal(result.kind, "allow");
     }
-    for (const name of ["image_build", "container_start", "container_remove", "volume_remove"]) {
+    for (const name of [
+        "image_build",
+        "container_start",
+        "container_remove",
+        "volume_remove",
+    ]) {
         const result = (await preExecutePolicy(sessionExec(name), () => Promise.resolve({ kind: "allow" }), undefined, undefined, testReadSession));
         assert.equal(result.kind, "deny", `${name} must be denied under read-only`);
         assert.ok(result.reason.includes("read-only"), `${name} deny reason`);
@@ -270,7 +289,9 @@ test("read-only denies the built-in file and shell tools", async () => {
     }
 });
 test("workspace-write and full access delegate the built-in file and shell tools", async () => {
-    for (const facts of [{ mode: "workspace-write", policy: "ask" }, { policy: "never" }]) {
+    for (const facts of [{ mode: "workspace-write", policy: "ask" }, {
+            policy: "never",
+        }]) {
         for (const name of ["write", "edit", "bash", "pwsh"]) {
             let delegated = false;
             const result = (await preExecutePolicy(sessionExec(name, facts), () => {
@@ -322,10 +343,18 @@ test("read-only wins over a never approval policy", async () => {
 });
 test("podman-ops preset asks for its approval-gated tools only", async () => {
     const workspaceWrite = { mode: "workspace-write", policy: "ask" };
-    const asked = (await preExecutePolicy(presetExec("container_bash", "podman-ops", { container: "valkey-ctr", command: "valkey-cli ping" }, workspaceWrite), () => Promise.resolve({ kind: "allow" }), undefined, undefined, testReadSession));
+    const asked = (await preExecutePolicy(presetExec("container_bash", "podman-ops", {
+        container: "valkey-ctr",
+        command: "valkey-cli ping",
+    }, workspaceWrite), () => Promise.resolve({ kind: "allow" }), undefined, undefined, testReadSession));
     assert.equal(asked.kind, "ask");
     assert.equal(asked.reason, 'Run a shell command in container "valkey-ctr": valkey-cli ping');
-    const daemon = (await preExecutePolicy(presetExec("daemon_start", "podman-ops", { container: "valkey-ctr", name: "v1", argv: ["valkey-server"], uid: 1001 }, workspaceWrite), () => Promise.resolve({ kind: "allow" }), undefined, undefined, testReadSession));
+    const daemon = (await preExecutePolicy(presetExec("daemon_start", "podman-ops", {
+        container: "valkey-ctr",
+        name: "v1",
+        argv: ["valkey-server"],
+        uid: 1001,
+    }, workspaceWrite), () => Promise.resolve({ kind: "allow" }), undefined, undefined, testReadSession));
     assert.equal(daemon.kind, "ask");
     assert.equal(daemon.reason, 'Start daemon "v1" in container "valkey-ctr": valkey-server (uid 1001)');
 });
@@ -350,10 +379,17 @@ test("podman-ops keeps open tools ungated and respects permissions", async () =>
     }, undefined, undefined, testReadSession));
     assert.equal(delegated, true, "image_list must stay open in podman-ops");
     assert.equal(open.kind, "allow");
-    const denied = (await preExecutePolicy(presetExec("container_bash", "podman-ops", { container: "c", command: "ls" }, { mode: "read-only" }), () => Promise.resolve({ kind: "allow" }), undefined, undefined, testReadSession));
+    const denied = (await preExecutePolicy(presetExec("container_bash", "podman-ops", {
+        container: "c",
+        command: "ls",
+    }, {
+        mode: "read-only",
+    }), () => Promise.resolve({ kind: "allow" }), undefined, undefined, testReadSession));
     assert.equal(denied.kind, "deny", "read-only wins over podman-ops approval");
     let fullDelegated = false;
-    const full = (await preExecutePolicy(presetExec("daemon_start", "podman-ops", { container: "c", argv: ["x"] }, { policy: "never" }), () => {
+    const full = (await preExecutePolicy(presetExec("daemon_start", "podman-ops", { container: "c", argv: ["x"] }, {
+        policy: "never",
+    }), () => {
         fullDelegated = true;
         return Promise.resolve({ kind: "allow" });
     }, undefined, undefined, testReadSession));
@@ -361,12 +397,45 @@ test("podman-ops keeps open tools ungated and respects permissions", async () =>
     assert.equal(full.kind, "allow");
 });
 test("summarizeArgs renders reasons for the podman-ops gated tools", () => {
-    assert.equal(summarizeArgs("container_exec", { container: "c", argv: ["python", "run.py", "--x", "1", "--y", "2", "--z", "3", "--w", "4", "--v", "5"] }), 'Run a command in container "c": python run.py --x 1 --y 2 --z 3 …');
-    assert.equal(summarizeArgs("container_write", { container: "c", file_path: "/etc/valkey/valkey.conf" }), 'Write "/etc/valkey/valkey.conf" in container "c".');
-    assert.equal(summarizeArgs("container_edit", { container: "c", file_path: "/etc/valkey/valkey.conf" }), 'Edit "/etc/valkey/valkey.conf" in container "c".');
-    assert.equal(summarizeArgs("container_bash", { container: "c", command: "ping -c 1 8.8.8.8" }), 'Run a shell command in container "c": ping -c 1 8.8.8.8');
-    assert.equal(summarizeArgs("container_bash", { container: "c", command: "ls", workdir: "/srv" }), 'Run a shell command in container "c" (cwd "/srv"): ls');
-    assert.equal(summarizeArgs("container_exec", { container: "c", argv: ["ls"], workdir: "/srv" }), 'Run a command in container "c" (cwd "/srv"): ls');
+    assert.equal(summarizeArgs("container_exec", {
+        container: "c",
+        argv: [
+            "python",
+            "run.py",
+            "--x",
+            "1",
+            "--y",
+            "2",
+            "--z",
+            "3",
+            "--w",
+            "4",
+            "--v",
+            "5",
+        ],
+    }), 'Run a command in container "c": python run.py --x 1 --y 2 --z 3 …');
+    assert.equal(summarizeArgs("container_write", {
+        container: "c",
+        file_path: "/etc/valkey/valkey.conf",
+    }), 'Write "/etc/valkey/valkey.conf" in container "c".');
+    assert.equal(summarizeArgs("container_edit", {
+        container: "c",
+        file_path: "/etc/valkey/valkey.conf",
+    }), 'Edit "/etc/valkey/valkey.conf" in container "c".');
+    assert.equal(summarizeArgs("container_bash", {
+        container: "c",
+        command: "ping -c 1 8.8.8.8",
+    }), 'Run a shell command in container "c": ping -c 1 8.8.8.8');
+    assert.equal(summarizeArgs("container_bash", {
+        container: "c",
+        command: "ls",
+        workdir: "/srv",
+    }), 'Run a shell command in container "c" (cwd "/srv"): ls');
+    assert.equal(summarizeArgs("container_exec", {
+        container: "c",
+        argv: ["ls"],
+        workdir: "/srv",
+    }), 'Run a command in container "c" (cwd "/srv"): ls');
 });
 test("summarizeArgs names the process identity and groups", () => {
     assert.equal(summarizeArgs("container_bash", {
@@ -376,7 +445,11 @@ test("summarizeArgs names the process identity and groups", () => {
         gid: 1000,
         groups: [3000, 4000],
     }), 'Run a shell command in container "c": id (uid 1000, gid 1000, groups 3000, 4000)');
-    assert.equal(summarizeArgs("container_exec", { container: "c", argv: ["id"], gid: 2000 }), 'Run a command in container "c": id (gid 2000)');
+    assert.equal(summarizeArgs("container_exec", {
+        container: "c",
+        argv: ["id"],
+        gid: 2000,
+    }), 'Run a command in container "c": id (gid 2000)');
     assert.equal(summarizeArgs("daemon_start", {
         container: "c",
         name: "web",
@@ -385,9 +458,14 @@ test("summarizeArgs names the process identity and groups", () => {
         groups: [3000],
     }), 'Start daemon "web" in container "c": nginx (uid 1000, groups 3000)');
     // An empty groups list is not worth naming.
-    assert.equal(summarizeArgs("container_exec", { container: "c", argv: ["id"], groups: [] }), 'Run a command in container "c": id');
+    assert.equal(summarizeArgs("container_exec", {
+        container: "c",
+        argv: ["id"],
+        groups: [],
+    }), 'Run a command in container "c": id');
 });
 test("Podman-ops preset content covers the recent tools", () => {
+    const patch = podmanOpsPatch();
     for (const tool of [
         "image_rebuild_all",
         "secret_list",
@@ -396,24 +474,26 @@ test("Podman-ops preset content covers the recent tools", () => {
         "container_secret_add",
         "container_secret_remove",
     ]) {
-        assert.ok(PODMAN_OPS_AGENT_CORDIS_YML.includes(tool), `podman-ops composition must mention ${tool}`);
+        assert.ok(patch.includes(tool), `podman-ops composition must mention ${tool}`);
     }
-    assert.ok(PODMAN_OPS_PRESET_YML.includes("secrets"), "podman-ops metadata must mention secrets");
+    assert.match(patch, /id: podman-ops/, "the preset row must carry the policy's preset id");
+    assert.ok(patch.includes("secrets"), "podman-ops metadata must mention secrets");
     // The persona plugin takes its prose as `prefix` (a required field); `text`
     // is not part of its schema and would make the preset fail to load.
-    assert.match(PODMAN_OPS_AGENT_CORDIS_YML, /prefix:/);
-    assert.doesNotMatch(PODMAN_OPS_AGENT_CORDIS_YML, /\btext:/);
+    assert.match(patch, /prefix:/);
+    assert.doesNotMatch(patch, /\btext:/);
 });
-test("Podman-ops preset writer overwrites existing content", () => {
-    const dir = mkdtempSync(join(tmpdir(), "dsh-podman-"));
-    ensurePodmanOpsPreset(undefined, dir);
-    const composition = join(dir, "agent.cordis.yml");
-    const metadata = join(dir, "preset.yml");
-    assert.equal(readFileSync(composition, "utf8"), PODMAN_OPS_AGENT_CORDIS_YML);
-    assert.equal(readFileSync(metadata, "utf8"), PODMAN_OPS_PRESET_YML);
-    writeFileSync(composition, "# stale user copy\n");
-    ensurePodmanOpsPreset(undefined, dir);
-    assert.equal(readFileSync(composition, "utf8"), PODMAN_OPS_AGENT_CORDIS_YML, "a second load must overwrite the stale copy");
+test("Podman-ops preset declares its composition as plugin rows", () => {
+    const patch = podmanOpsPatch();
+    for (const plugin of [
+        "@deepseek-ai/dsh-persona",
+        "@deepseek-ai/dsh-tool-ask-user",
+        "@deepseek-ai/dsh-tool-todo",
+        "@deepseek-ai/dsh-tool-web",
+    ]) {
+        assert.ok(patch.includes(plugin), `podman-ops composition must declare ${plugin}`);
+    }
+    assert.ok(patch.includes("@deepseek-ai/dsh-agent-preset"), "the preset must be declared through the agent-preset row");
 });
 test("summarizeArgs includes PATH additions for container start/recreate", () => {
     assert.equal(summarizeArgs("container_start", { container: "web", paths: ["/opt/bin"] }), 'Start container "web" with PATH additions: "/opt/bin".');
@@ -443,7 +523,18 @@ test("summarizeArgs includes env keys for container start/recreate", () => {
     }), 'Start container "web" from image "localhost/dsh-podman/nginx:latest" with mounts: project "team" (read-only) with env: A, B, C.');
     assert.equal(summarizeArgs("container_start", {
         container: "web",
-        env: { A: "1", B: "2", C: "3", D: "4", E: "5", F: "6", G: "7", H: "8", I: "9", J: "10" },
+        env: {
+            A: "1",
+            B: "2",
+            C: "3",
+            D: "4",
+            E: "5",
+            F: "6",
+            G: "7",
+            H: "8",
+            I: "9",
+            J: "10",
+        },
     }), 'Start container "web" with env: A, B, C, D, E, F, G, H, +2 more.');
     assert.equal(summarizeArgs("container_recreate", {
         container: "c",
@@ -460,3 +551,43 @@ test("approval prompts name the resolved path", () => {
     assert.equal(summarizeArgs("container_write", { container: "c", file_path: "notes.md" }), 'Write "notes.md" in container "c".');
     assert.equal(summarizeArgs("container_write", { container: "c", file_path: "../x" }, "/projects/team"), 'Write "../x" in container "c".');
 });
+test("summarizeArgs includes secret env names for container start/recreate", () => {
+    assert.equal(summarizeArgs("container_start", {
+        container: "web",
+        secretEnv: { TOKEN: "api-token" },
+    }), 'Start container "web" with secret env: TOKEN.');
+    assert.equal(summarizeArgs("container_recreate", {
+        container: "c",
+        env: { A: "1" },
+        secretEnv: { TOKEN: "api-token" },
+    }), 'Recreate container "c" with env: A with secret env: TOKEN.');
+    // An empty map is not an attachment and is not named.
+    assert.equal(summarizeArgs("container_start", { container: "web", secretEnv: {} }), 'Start container "web".');
+});
+test("container_start asks for approval when it attaches secrets", () => {
+    // Plain env, paths, and a bare start stay prompt-free by design: the caller
+    // already knows those values, unlike a secret the container injects.
+    assert.equal(approvalDecision("container_start", { container: "web" }), undefined);
+    assert.equal(approvalDecision("container_start", {
+        container: "web",
+        paths: ["/opt/bin"],
+    }), undefined);
+    assert.equal(approvalDecision("container_start", { container: "web", env: { A: "1" } }), undefined);
+    assert.equal(approvalDecision("container_start", { container: "web", secretEnv: {} }), undefined);
+    // Mounts and secret attachments both change what the container can reach.
+    assert.equal(approvalDecision("container_start", {
+        container: "web",
+        mounts: [{ project: "team" }],
+    })?.kind, "ask");
+    const withSecret = approvalDecision("container_start", {
+        container: "web",
+        secretEnv: { TOKEN: "api-token" },
+    });
+    assert.equal(withSecret?.kind, "ask");
+    assert.match(withSecret?.reason ?? "", /secret env: TOKEN/);
+});
+test("the bundle patch disables the built-in terminal UI", () => {
+    // The Podman terminal replaces the built-in one; its client row must stay off
+    // so the guide offers a single terminal card and Ctrl+` is free.
+    assert.match(podmanOpsPatch(), /- id: ui-sidebar-terminal\n\s+disabled: true/);
+});

package/dist/card-route.d.ts

@@ -1,4 +1,5 @@
 import { type CardSnapshot } from "./client/card-protocol.js";
+import { type ReasonLocale } from "./approval-reasons.js";
 import { type WorkspaceResolver } from "./workspace-binding.js";
 /** Build the live snapshot the card renders. */
 export declare function cardSnapshot(resolver: WorkspaceResolver, workspaceRegistry: any): Promise<CardSnapshot>;
@@ -6,10 +7,10 @@ export declare function cardSnapshot(resolver: WorkspaceResolver, workspaceRegis
  * Run one card command, returning the notice to show (usually empty). `ctx` is
  * the settings-injected context, read only for the session locale.
  */
-export declare function runCommand(ctx: any, resolver: WorkspaceResolver, workspaceRegistry: any, raw: Record<string, unknown>): Promise<string>;
+export declare function runCommand(_ctx: any, resolver: WorkspaceResolver, workspaceRegistry: any, raw: Record<string, unknown>, readLocale?: () => ReasonLocale): Promise<string>;
 /**
  * Register the card's authenticated fetch route. It is served below the
  * harness API path, so the carrier applies its Host/Origin fence and browser
  * authentication before the handler runs.
  */
-export declare function registerCardRoute(ctx: any, resolver: WorkspaceResolver, workspaceRegistry?: any): void;
+export declare function registerCardRoute(ctx: any, resolver: WorkspaceResolver, workspaceRegistry?: any, readLocale?: () => ReasonLocale): void;

package/dist/card-route.js

@@ -6,8 +6,10 @@
 // request, so neither the snapshot nor the commands touch the persisted
 // settings document.
 import { CARD_PATH, } from "./client/card-protocol.js";
-import { renderCacheCleanNotice, resolveReasonLocale } from "./approval-reasons.js";
-import { defaultMountMode, mountKindToProto, mountModeToProto } from "./mount-enums.js";
+import { renderCacheCleanNotice, renderDefaultEnvSyncNotice, resolveReasonLocale, } from "./approval-reasons.js";
+import { mergeDefaultEnv, missingDefaultEnv } from "./container-env.js";
+import { defaultMountMode, mountKindToProto, mountModeToProto, } from "./mount-enums.js";
+import { mountInputToProto, validateMountInput } from "./mount-input.js";
 import { unaryGuest } from "./guest-rpc.js";
 import { workspaceSlug } from "./workspace-binding.js";
 import { GIT_COMMIT, VERSION } from "./generated/version.js";
@@ -38,17 +40,32 @@ function cacheCleanModeToProto(mode) {
         throw new Error(`unknown cache clean mode: ${mode}`);
     return proto;
 }
-function mountInputToProto(mount) {
-    const kind = mountKindToProto(mount.kind || undefined);
-    const mode = mountModeToProto(mount.mode || defaultMountMode(mount.kind || undefined));
-    const result = { projectName: mount.project ?? "", kind, mode };
-    if (kind !== "MOUNT_KIND_PROJECT" && mount.destination)
-        result.destination = mount.destination;
-    if (mount.volume)
-        result.volume = mount.volume;
-    if (mount.secret)
-        result.secret = mount.secret;
-    return result;
+// containerMountView and imageView rebuild the snapshot's nested objects from
+// an explicit allow-list, so a field added to the proto later cannot reach the
+// browser just because it exists on the wire (see AGENTS.md "Security").
+function containerMountView(mount) {
+    return {
+        projectName: stringField(mount?.projectName),
+        destination: stringField(mount?.destination),
+        kind: stringField(mount?.kind),
+        mode: stringField(mount?.mode),
+        volume: stringField(mount?.volume),
+        secret: stringField(mount?.secret),
+    };
+}
+function imageView(image) {
+    return {
+        imageId: stringField(image?.imageId),
+        parent: stringField(image?.parent),
+        packages: Array.isArray(image?.packages) ? image.packages.map(String) : [],
+        imageTag: stringField(image?.imageTag),
+        builtAt: stringField(image?.builtAt),
+        isBase: Boolean(image?.isBase),
+        status: stringField(image?.status),
+        primitive: stringField(image?.primitive),
+        packageManager: stringField(image?.packageManager),
+        basePublic: Boolean(image?.basePublic),
+    };
 }
 function orchestratorWorkspaceViews(raw) {
     return (raw ?? []).map((workspace) => ({
@@ -76,12 +93,15 @@ function dshWorkspaceViews(registry, projectsRoot) {
             : path;
         return {
             workspaceSlug: workspaceSlug(workspace.id),
-            projectName: projectName || String(workspace.title ?? "") || String(workspace.id ?? ""),
+            projectName: projectName || String(workspace.title ?? "") ||
+                String(workspace.id ?? ""),
             containerName: "",
             imageId: "",
             status: "",
             createdAt: workspace.createdAt ?? "",
-            mounts: projectName !== "" ? [{ projectName, mode: "MOUNT_MODE_READ_WRITE" }] : [],
+            mounts: projectName !== ""
+                ? [{ projectName, mode: "MOUNT_MODE_READ_WRITE" }]
+                : [],
         };
     });
 }
@@ -130,8 +150,9 @@ export async function cardSnapshot(resolver, workspaceRegistry) {
     catch (error) {
         // An incompatible plugin is refused before any handler runs, so the card
         // reports the mismatch instead of an unexplained empty snapshot.
-        if (error?.code !== "FailedPrecondition")
+        if (error?.code !== "FailedPrecondition") {
             throw error;
+        }
         return {
             version: VERSION,
             commit: GIT_COMMIT,
@@ -162,12 +183,12 @@ export async function cardSnapshot(resolver, workspaceRegistry) {
             imageId: container.imageId ?? "",
             status: container.status ?? "",
             createdAt: container.createdAt ?? "",
-            mounts: container.mounts ?? [],
+            mounts: (container.mounts ?? []).map(containerMountView),
             paths: container.paths ?? [],
             env: container.env ?? {},
             secretEnv: container.secretEnv ?? {},
         })),
-        images: images.images ?? [],
+        images: (images.images ?? []).map(imageView),
         volumes: (volumes.volumes ?? []).map((volume) => ({
             name: volume.name ?? "",
         })),
@@ -187,7 +208,9 @@ export async function cardSnapshot(resolver, workspaceRegistry) {
  * Run one card command, returning the notice to show (usually empty). `ctx` is
  * the settings-injected context, read only for the session locale.
  */
-export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
+export async function runCommand(_ctx, resolver, workspaceRegistry, raw, 
+// The live UI locale, read per notice; absent in tests, which render English.
+readLocale) {
     const command = normalizeCommand(raw);
     let notice = "";
     switch (command.op) {
@@ -196,13 +219,18 @@ export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
                 workspaceSlug: command.workspace,
                 imageId: command.image === "" ? undefined : command.image,
             };
-            const mounts = command.mounts.map(mountInputToProto);
+            const projectsRoot = resolver.getConfig().projectsRoot;
+            const mounts = command.mounts.map((mount) => mountInputToProto(mount, projectsRoot));
             if (mounts.length > 0)
                 payload.mounts = mounts;
-            if (Object.keys(command.env).length > 0)
-                payload.env = command.env;
-            if (Object.keys(command.secretEnvMap).length > 0) {
-                payload.secretEnv = command.secretEnvMap;
+            // The card's create is a creation path: seed the default environment
+            // under whatever the modal collected. A later recreate is authoritative,
+            // which is how a seeded value is removed again.
+            const env = mergeDefaultEnv(resolver.getConfig().containerEnv, command.env);
+            if (Object.keys(env).length > 0)
+                payload.env = env;
+            if (Object.keys(command.secretEnv).length > 0) {
+                payload.secretEnv = command.secretEnv;
             }
             if (command.paths.length > 0)
                 payload.paths = [...command.paths];
@@ -224,6 +252,7 @@ export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
             const m = command.mount;
             if (m === null)
                 break;
+            validateMountInput(m, resolver.getConfig().projectsRoot);
             const kind = mountKindToProto(m.kind || undefined);
             const mode = mountModeToProto(m.mode || defaultMountMode(m.kind || undefined));
             const request = {
@@ -282,6 +311,9 @@ export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
             const m = command.mount;
             if (m === null)
                 break;
+            // An update sets a mode, so a secret mount must not be made read-write
+            // here either.
+            validateMountInput(m, resolver.getConfig().projectsRoot);
             const kind = mountKindToProto(m.kind || undefined);
             const request = {
                 workspaceSlug: command.workspace,
@@ -321,6 +353,7 @@ export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
         case "remove":
             await resolver.control("removeContainer", {
                 workspaceSlug: command.workspace,
+                ...(command.container !== "" ? { container: command.container } : {}),
             });
             break;
         case "workspace_remove":
@@ -331,6 +364,7 @@ export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
         case "recreate":
             await resolver.control("recreateContainer", {
                 workspaceSlug: command.workspace,
+                ...(command.container !== "" ? { container: command.container } : {}),
                 imageId: command.image === "" ? undefined : command.image,
                 ...(Object.keys(command.env).length > 0 ? { env: command.env } : {}),
             });
@@ -370,7 +404,7 @@ export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
             await resolver.control("addContainerSecret", {
                 workspaceSlug: command.workspace,
                 container: command.container || "default",
-                env: command.secretEnv,
+                env: command.secretEnvName,
                 secret: command.secret,
             });
             break;
@@ -378,7 +412,7 @@ export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
             await resolver.control("removeContainerSecret", {
                 workspaceSlug: command.workspace,
                 container: command.container || "default",
-                env: command.secretEnv,
+                env: command.secretEnvName,
             });
             break;
         case "image_build":
@@ -394,11 +428,44 @@ export async function runCommand(ctx, resolver, workspaceRegistry, raw) {
         case "image_base_pull":
             await resolver.control("pullBaseImage", { name: command.workspace });
             break;
+        case "default_env_sync": {
+            // Add the default environment to containers that already exist. Only the
+            // keys a container is missing are added, so an explicit value is never
+            // overwritten, and a stopped container is left for its next start (which
+            // seeds the defaults). A recreate applies the merged map.
+            const defaults = resolver.getConfig().containerEnv ?? {};
+            if (Object.keys(defaults).length === 0)
+                break;
+            const listings = await resolver.control("listContainers", {});
+            let applied = 0;
+            let skipped = 0;
+            for (const row of listings.containers ?? []) {
+                if (command.workspace !== "" && row.workspaceSlug !== command.workspace) {
+                    continue;
+                }
+                const current = (row.env ?? {});
+                const missing = missingDefaultEnv(defaults, current);
+                if (Object.keys(missing).length === 0)
+                    continue;
+                if (row.status !== "running") {
+                    skipped++;
+                    continue;
+                }
+                await resolver.control("recreateContainer", {
+                    workspaceSlug: row.workspaceSlug,
+                    container: row.containerName,
+                    env: mergeDefaultEnv(defaults, current),
+                });
+                applied++;
+            }
+            notice = renderDefaultEnvSyncNotice(resolveReasonLocale(readLocale?.()), applied, skipped);
+            break;
+        }
         case "cache_clean": {
             const result = (await resolver.control("cleanCaches", {
                 mode: cacheCleanModeToProto(command.cacheMode),
             }));
-            notice = renderCacheCleanNotice(resolveReasonLocale(ctx?.settings), Number(result.removedFiles ?? 0));
+            notice = renderCacheCleanNotice(resolveReasonLocale(readLocale?.()), Number(result.removedFiles ?? 0));
             break;
         }
         default:
@@ -416,8 +483,9 @@ function stringField(value, fallback = "") {
     return typeof value === "string" ? value : fallback;
 }
 function stringMap(value) {
-    if (typeof value !== "object" || value === null || Array.isArray(value))
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
         return {};
+    }
     const result = {};
     for (const [key, item] of Object.entries(value)) {
         result[key] = String(item);
@@ -460,16 +528,16 @@ function normalizeCommand(raw) {
         env: stringMap(raw.env),
         container: stringField(raw.container),
         secret: stringField(raw.secret),
-        secretEnv: stringField(raw.secretEnv),
+        secretEnvName: stringField(raw.secretEnvName),
         length: typeof raw.length === "number" ? raw.length : 0,
         charset: stringField(raw.charset),
         packages: Array.isArray(raw.packages) ? raw.packages.map(String) : [],
-        secretEnvMap: stringMap(raw.secretEnvMap),
+        secretEnv: stringMap(raw.secretEnv),
         cacheMode: stringField(raw.cacheMode),
         mount: mountField(raw.mount),
     };
 }
-async function handleCardRequest(request, ctx, resolver, workspaceRegistry) {
+async function handleCardRequest(request, ctx, resolver, workspaceRegistry, readLocale) {
     if (request.method === "GET") {
         try {
             return jsonResponse(200, await cardSnapshot(resolver, workspaceRegistry));
@@ -495,7 +563,7 @@ async function handleCardRequest(request, ctx, resolver, workspaceRegistry) {
         return jsonResponse(400, { error: "a command is required" });
     }
     try {
-        const notice = await runCommand(ctx, resolver, workspaceRegistry, command);
+        const notice = await runCommand(ctx, resolver, workspaceRegistry, command, readLocale);
         const result = notice === "" ? {} : { notice };
         return jsonResponse(200, result);
     }
@@ -510,13 +578,13 @@ async function handleCardRequest(request, ctx, resolver, workspaceRegistry) {
  * harness API path, so the carrier applies its Host/Origin fence and browser
  * authentication before the handler runs.
  */
-export function registerCardRoute(ctx, resolver, workspaceRegistry) {
-    ctx.inject(["connection", "settings"], (connectionCtx) => {
+export function registerCardRoute(ctx, resolver, workspaceRegistry, readLocale) {
+    ctx.inject(["connection"], (connectionCtx) => {
         connectionCtx.connection.fetch.register({
             path: CARD_PATH,
             methods: ["GET", "POST"],
             requestBody: "buffered",
-            fetch: (request) => handleCardRequest(request, connectionCtx, resolver, workspaceRegistry),
+            fetch: (request) => handleCardRequest(request, connectionCtx, resolver, workspaceRegistry, readLocale),
         });
     });
 }