Fix session resume and PSD container configuration

backend/test/pi-process-manager.test.ts

@@ -350,7 +350,14 @@ test("skips managed-key injection for a provider present in pi's auth store", as
 
 test("session Pi spawn reads the single secret bundle and scrubs its path", async () => {
   const secret = path.resolve(__dirname, `.bundle-${process.pid}`);
-  writeFileSync(secret, "THT_MODEL_API_KEY=bundle-secret\n", { mode: 0o600 });
+  writeFileSync(secret, [
+    "THT_MODEL_API_KEY=bundle-secret",
+    "THT_DWH_API_KEY=dwh-secret",
+    "THT_VEC_API_KEY=vector-reader-secret",
+    "THT_VEC_WRITE_API_KEY=vector-writer-secret",
+    "THT_CA=/run/secrets/ca-chain.pem",
+    "",
+  ].join("\n"), { mode: 0o600 });
   chmodSync(secret, 0o600);
   const calls: any[][] = [];
   const child = recordingChild();
@@ -361,6 +368,13 @@ test("session Pi spawn reads the single secret bundle and scrubs its path", asyn
   try {
     await mgr.spawnFor("bundle-session", { provider: "openai" });
     expect(calls[0][2].env.OPENAI_API_KEY).toBe("bundle-secret");
+    expect(calls[0][2].env).toMatchObject({
+      THT_DWH_API_KEY: "dwh-secret",
+      THT_VEC_API_KEY: "vector-reader-secret",
+      THT_VEC_WRITE_API_KEY: "vector-writer-secret",
+      THT_CA: "/run/secrets/ca-chain.pem",
+      THT_SSL_CA: "/run/secrets/ca-chain.pem",
+    });
     expect(calls[0][2].env).not.toHaveProperty("THT_SECRETS_FILE");
   } finally {
     mgr.teardown("bundle-session");

backend/test/tht-runner.test.ts

@@ -1,5 +1,8 @@
 import { test, expect, vi } from "vitest";
 import { EventEmitter } from "node:events";
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { ThtRunner } from "../src/tht/tht-runner.js";
 
 // Spy on child_process.spawn so we can capture the resolved argv (incl. -c config)
@@ -63,6 +66,41 @@ test("run passes configured THT_DATA_ROOT and preserves the remaining environmen
   }
 });
 
+test("run injects DWH/vector credentials from the mounted secret bundle", async () => {
+  const dir = mkdtempSync(join(tmpdir(), "tht-runner-bundle-"));
+  const secret = join(dir, "thothii.secrets");
+  writeFileSync(secret, [
+    "THT_DWH_API_KEY=dwh-secret",
+    "THT_VEC_API_KEY=vector-reader-secret",
+    "THT_VEC_WRITE_API_KEY=vector-writer-secret",
+    "THT_CA=/run/secrets/ca-chain.pem",
+    "",
+  ].join("\n"), { mode: 0o600 });
+  chmodSync(secret, 0o600);
+  try {
+    (spawn as any).mockClear();
+    const runner = new ThtRunner({
+      thtBin: "tht",
+      harnessDir: "/app/harness",
+      configPath: "config/tht.yaml",
+      secretsFile: secret,
+    } as any);
+
+    await runner.run(["session", "list", "--json"]);
+
+    const env = (spawn as any).mock.calls[0][2].env;
+    expect(env).toMatchObject({
+      THT_DWH_API_KEY: "dwh-secret",
+      THT_VEC_API_KEY: "vector-reader-secret",
+      THT_VEC_WRITE_API_KEY: "vector-writer-secret",
+      THT_CA: "/run/secrets/ca-chain.pem",
+      THT_SSL_CA: "/run/secrets/ca-chain.pem",
+    });
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 test("run omits ambient THT_DATA_ROOT when config does not provide one", async () => {
   const previousDataRoot = process.env.THT_DATA_ROOT;
   const previousCredential = process.env.PI_PROVIDER_API_KEY;