Fix session resume and PSD container configuration

backend/src/app.ts

@@ -40,6 +40,8 @@ export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstanc
     harnessDir: config.harnessDir,
     configPath: process.env.THT_CONFIG ?? "config/tht.yaml",
     dataRoot: config.dataRoot,
+    secretsFile: config.secretsFile,
+    secretFiles: config.secretFiles,
   });
   const mgr = deps?.mgr ?? new PiProcessManager(config, deps?.spawnFn ? { spawnFn: deps.spawnFn } : undefined);
   const hub = deps?.hub ?? new SseHub();

backend/src/pi/pi-process-manager.ts

@@ -68,9 +68,18 @@ export class PiProcessManager {
     // this managed session process the adapter values already loaded by the core
     // entrypoint; the generic provider helper continues to scrub them by default.
     for (const name of [
-      "THT_DWH_API_KEY", "THT_VEC_API_KEY", "THT_VEC_WRITE_API_KEY", "THT_SSL_CA",
+      "THT_DWH_API_KEY", "THT_VEC_API_KEY", "THT_VEC_WRITE_API_KEY",
     ] as const) {
-      if (process.env[name] !== undefined) env[name] = process.env[name];
+      const value = secretValue(this.cfg, name) ?? process.env[name];
+      if (value !== undefined) env[name] = value;
+    }
+    const ca = secretValue(this.cfg, "THT_SSL_CA")
+      ?? secretValue(this.cfg, "THT_CA")
+      ?? process.env.THT_SSL_CA
+      ?? process.env.THT_CA;
+    if (ca !== undefined) {
+      env.THT_CA = ca;
+      env.THT_SSL_CA = ca;
     }
     delete env.THT_DATA_ROOT;
     if (this.cfg.dataRoot !== undefined) env.THT_DATA_ROOT = this.cfg.dataRoot;

backend/src/tht/tht-runner.ts

@@ -2,8 +2,9 @@ import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { clearPrincipalEnvironment, principalEnvironment, type PrincipalContext } from "../auth/principal.js";
+import { secretValue, type SecretBundleConfig } from "../config/secret-bundle.js";
 
-export interface ThtConfig {
+export interface ThtConfig extends SecretBundleConfig {
   thtBin: string;
   harnessDir: string;
   configPath: string;
@@ -82,6 +83,17 @@ export class ThtRunner {
       clearPrincipalEnvironment(env);
       if (this.cfg.dataRoot !== undefined) env.THT_DATA_ROOT = this.cfg.dataRoot;
       if (this.principal) Object.assign(env, principalEnvironment(this.principal));
+      for (const name of [
+        "THT_DWH_API_KEY", "THT_VEC_API_KEY", "THT_VEC_WRITE_API_KEY",
+      ] as const) {
+        const value = secretValue(this.cfg, name);
+        if (value !== undefined) env[name] = value;
+      }
+      const ca = secretValue(this.cfg, "THT_SSL_CA") ?? secretValue(this.cfg, "THT_CA");
+      if (ca !== undefined) {
+        env.THT_CA = ca;
+        env.THT_SSL_CA = ca;
+      }
       const ch = spawn(this.cfg.thtBin, this.buildArgv(args, workspace), {
         cwd: this.cfg.harnessDir,
         env,