pinokiod 5.1.10 → 5.1.17

package/server/index.js

@@ -18,7 +18,7 @@ const cors = require('cors');
 const path = require("path")
 const fs = require('fs');
 const os = require('os')
-const { fork, exec } = require('child_process');
+const { fork, execFile } = require('child_process');
 const semver = require('semver')
 const fse = require('fs-extra')
 const QRCode = require('qrcode')
@@ -68,18 +68,6 @@ const Setup = require("../kernel/bin/setup")
       return (str.endsWith('\n') ? str : str + '\n').replace(/\r\n/g, '\n');
     }
 
-    this.gitEnv = (repoPath) => {
-      const gitBin = this.kernel.bin && this.kernel.bin.git ? this.kernel.bin.git : null
-      if (gitBin && typeof gitBin.env === 'function') {
-        const env = gitBin.env(repoPath)
-        if (this.kernel.git && typeof this.kernel.git.clearStaleLock === "function" && repoPath) {
-          this.kernel.git.clearStaleLock(repoPath).catch(() => {})
-        }
-        return env
-      }
-      return {}
-    }
-
 class Server {
   constructor(config) {
     this.tabs = {}
@@ -103,7 +91,6 @@ class Server {
     this.kernel.version = this.version
     this.upload = multer();
     this.cf = new Cloudflare()
-    this.virtualEnvCache = new Map()
     this.gitStatusIgnorePatterns = [
       /(^|\/)node_modules\//,
 //      /(^|\/)vendor\//,
@@ -121,9 +108,28 @@ class Server {
       /(^|\/)\.pytest_cache\//,
       /(^|\/)\.git\//
     ]
+    this.apiGitRefreshTimer = null
     this.workspaceStatus = new WorkspaceStatusManager({
       enableWatchers: process.env.PINOKIO_DISABLE_WATCH === '1' ? false : true,
       fallbackIntervalMs: 60000,
+      onEvent: (workspaceName, events) => {
+        if (!this.kernel.homedir) return
+        if (!events || events.length === 0) return
+        const apiRoot = this.kernel.path('api')
+        const topLevel = events.some(({ path: evtPath, type }) => {
+          if (!evtPath) return false
+          const rel = path.relative(apiRoot, evtPath)
+          if (!rel || rel.startsWith('..') || path.isAbsolute(rel)) return false
+          const parts = rel.split(path.sep)
+          return parts.length === 1 && (type === 'create' || type === 'delete')
+        })
+        if (topLevel) {
+          if (this.apiGitRefreshTimer) clearTimeout(this.apiGitRefreshTimer)
+          this.apiGitRefreshTimer = setTimeout(() => {
+            this.kernel.git.repos(apiRoot).catch(() => {})
+          }, 1000)
+        }
+      },
     })
 
     // sometimes the C:\Windows\System32 is not in PATH, need to add
@@ -857,6 +863,7 @@ class Server {
   }
 
   async chrome(req, res, type, options) {
+    console.log("Chrome")
 
     let d = Date.now()
     console.time("bin check")
@@ -1092,6 +1099,13 @@ class Server {
       git_fork_url: `/run/scripts/git/fork.json?cwd=${encodeURIComponent(this.kernel.path('api', name))}`
 //      rawpath,
     }
+    result.hasSnapshots = !!(options && options.hasSnapshots)
+    result.pendingSnapshotId = options && options.pendingSnapshotId ? String(options.pendingSnapshotId) : null
+    const registryBetaEnabled = await this.isRegistryBetaEnabled().catch(() => false)
+    result.registryBetaEnabled = registryBetaEnabled
+    if (!registryBetaEnabled) {
+      result.pendingSnapshotId = null
+    }
 //    if (!this.kernel.proto.config) {
 //      await this.kernel.proto.init()
 //    }
@@ -1112,259 +1126,279 @@ class Server {
     }
     return { editorUrl, prevUrl }
   }
-  get_shell_id(name, i, rendered) {
-    let shell_id
-    if (rendered.id) {
-      shell_id = encodeURIComponent(`${name}_${rendered.id}`)
-    } else {
-      let hash = crypto.createHash('md5').update(JSON.stringify(rendered)).digest('hex')
-      //shell_id = encodeURIComponent(`${name}_${i}_session_${hash}`)
-      shell_id = encodeURIComponent(`${name}_session_${hash}`)
-    }
-    return shell_id
-  }
-  is_subpath(parent, child) {
-    const relative = path.relative(parent, child);
-    let check = !!relative && !relative.startsWith('..') && !path.isAbsolute(relative);
-    return check
+  parseRegistryBetaValue(value) {
+    if (value === true) return true
+    if (value === false) return false
+    if (value == null) return null
+    const str = String(value).trim().toLowerCase()
+    if (!str) return null
+    if (["1", "true", "yes", "on", "enable", "enabled"].includes(str)) return true
+    if (["0", "false", "no", "off", "disable", "disabled"].includes(str)) return false
+    return null
   }
-  async discoverVirtualEnvDirs(dir) {
-    const cacheKey = path.resolve(dir)
-    const cached = this.virtualEnvCache.get(cacheKey)
-    const now = Date.now()
-    if (cached && cached.timestamp && (now - cached.timestamp) < 60000) {
-      return cached.dirs
-    }
-
-    const normalizePath = (p) => p.replace(/\\/g, '/').replace(/\/+/g, '/')
-    const ignored = new Set()
-    const autoExclude = new Set()
-    const seen = new Set()
-    const stack = [{ abs: dir, rel: '', depth: 0 }]
-    const maxDepth = 6
-
-    const shouldIgnoreRelative = (relative) => {
-      if (!relative) {
-        return false
+  async isRegistryBetaEnabled() {
+    let raw = null
+    try {
+      const env = await Environment.get(this.kernel.homedir, this.kernel)
+      if (env && Object.prototype.hasOwnProperty.call(env, "PINOKIO_REGISTRY_BETA")) {
+        raw = env.PINOKIO_REGISTRY_BETA
       }
-      const normalized = normalizePath(relative)
-      return this.gitStatusIgnorePatterns.some((regex) => regex.test(normalized) || regex.test(`${normalized}/`))
+    } catch (_) {}
+    if (raw == null && process.env.PINOKIO_REGISTRY_BETA != null) {
+      raw = process.env.PINOKIO_REGISTRY_BETA
     }
-
-    while (stack.length > 0) {
-      const { abs, rel, depth } = stack.pop()
-      const normalizedAbs = normalizePath(abs)
-      if (seen.has(normalizedAbs)) {
-        continue
-      }
-      seen.add(normalizedAbs)
-
-      let stats
-      try {
-        stats = await fs.promises.stat(abs)
-      } catch (err) {
-        continue
+    return this.parseRegistryBetaValue(raw) === true
+  }
+  async updateEnvironmentVars(updates) {
+    await Environment.init({}, this.kernel)
+    const fullpath = path.resolve(this.kernel.homedir, "ENVIRONMENT")
+    await Util.update_env(fullpath, updates)
+  }
+  async getRegistryConfig() {
+    let url = null
+    let apiKey = null
+    try {
+      const env = await Environment.get(this.kernel.homedir, this.kernel)
+      if (env && env.PINOKIO_REGISTRY_URL) {
+        const v = String(env.PINOKIO_REGISTRY_URL).trim()
+        if (v) url = v
       }
-      if (!stats.isDirectory()) {
-        continue
+      if (env && env.PINOKIO_REGISTRY_API_KEY) {
+        const v = String(env.PINOKIO_REGISTRY_API_KEY).trim()
+        if (v) apiKey = v
       }
-
-      const relPath = rel ? normalizePath(rel) : ''
-      if (relPath && shouldIgnoreRelative(relPath)) {
-        ignored.add(relPath)
-        const relSegments = relPath.split('/')
-        const lastSegment = relSegments[relSegments.length - 1]
-        if (lastSegment && ['node_modules', '.venv', 'venv', '.virtualenv', 'env'].includes(lastSegment)) {
-          autoExclude.add(relPath)
+    } catch (_) {}
+    if ((url == null || apiKey == null) && this.kernel && this.kernel.store) {
+      const registry = this.kernel.store.get('registry') || {}
+      const updates = {}
+      if (url == null && registry.url) {
+        const v = String(registry.url).trim()
+        if (v) {
+          url = v
+          updates.PINOKIO_REGISTRY_URL = v
         }
-        continue
       }
-
-      const entries = await fs.promises.readdir(abs, { withFileTypes: true }).catch(() => [])
-      let hasPyvenvCfg = false
-      let hasExecutables = false
-      let hasSitePackages = false
-      let hasInclude = false
-      let hasNestedGit = false
-
-      for (const entry of entries) {
-        if (entry.name === '.git') {
-          let treatAsGit = false
-          if (entry.isDirectory && entry.isDirectory()) {
-            treatAsGit = true
-          } else if (entry.isFile && entry.isFile()) {
-            treatAsGit = true
-          } else if (entry.isSymbolicLink && entry.isSymbolicLink()) {
-            treatAsGit = true
-          }
-          if (treatAsGit) {
-            hasNestedGit = true
-          }
+      if (apiKey == null && registry.apiKey) {
+        const v = String(registry.apiKey).trim()
+        if (v) {
+          apiKey = v
+          updates.PINOKIO_REGISTRY_API_KEY = v
         }
-        if (entry.isFile() && entry.name === 'pyvenv.cfg') {
-          hasPyvenvCfg = true
-        }
-        if (!entry.isDirectory()) {
-          continue
-        }
-        const lower = entry.name.toLowerCase()
-        if (lower === 'include') {
-          hasInclude = true
-        }
-        if (lower === 'bin' || lower === 'scripts') {
-          const execEntries = await fs.promises.readdir(path.join(abs, entry.name)).catch(() => [])
-          if (execEntries.some((name) => /^activate(\..*)?$/i.test(name) || /^python(\d*(\.\d+)*)?(\.exe)?$/i.test(name))) {
-            hasExecutables = true
-          }
-        }
-        if (lower === 'site-packages') {
-          hasSitePackages = true
-        }
-        if (lower === 'lib' || lower === 'lib64') {
-          const libPath = path.join(abs, entry.name)
-          const libEntries = await fs.promises.readdir(libPath, { withFileTypes: true }).catch(() => [])
-          for (const libEntry of libEntries) {
-            if (!libEntry.isDirectory()) {
-              continue
-            }
-            if (/^python\d+(\.\d+)?$/i.test(libEntry.name)) {
-              const sitePackages = path.join(libPath, libEntry.name, 'site-packages')
-              try {
-                const siteStats = await fs.promises.stat(sitePackages)
-                if (siteStats.isDirectory()) {
-                  hasSitePackages = true
-                  break
-                }
-              } catch (err) {}
-            }
-            if (libEntry.name === 'site-packages') {
-              hasSitePackages = true
-              break
-            }
-          }
-        }
-      }
-
-      const looksLikeVenv = hasPyvenvCfg || (hasExecutables && (hasSitePackages || hasInclude))
-      if (looksLikeVenv && relPath) {
-        ignored.add(relPath)
-        autoExclude.add(relPath)
-        continue
-      }
-
-      if (hasNestedGit && relPath) {
-        ignored.add(relPath)
-        autoExclude.add(relPath)
-        continue
       }
-
-      if (depth >= maxDepth) {
-        continue
-      }
-
-      for (const entry of entries) {
-        if (!entry.isDirectory()) {
-          continue
-        }
-        const childRel = rel ? `${rel}/${entry.name}` : entry.name
-        stack.push({ abs: path.join(abs, entry.name), rel: childRel, depth: depth + 1 })
+      if (Object.keys(updates).length) {
+        await this.updateEnvironmentVars(updates).catch(() => {})
       }
     }
-
-    this.virtualEnvCache.set(cacheKey, { dirs: ignored, timestamp: now })
-    if (autoExclude.size > 0) {
-      try {
-        await this.syncGitInfoExclude(dir, autoExclude)
-      } catch (error) {
-        console.warn('syncGitInfoExclude failed', dir, error)
+    return { url, apiKey }
+  }
+  async getRegistryConnectUrl() {
+    let raw = null
+    let source = null
+    try {
+      const env = await Environment.get(this.kernel.homedir, this.kernel)
+      if (env && Object.prototype.hasOwnProperty.call(env, "PINOKIO_REGISTRY_CONNECT_URL")) {
+        raw = env.PINOKIO_REGISTRY_CONNECT_URL
+        source = "env-url"
+      } else if (env && Object.prototype.hasOwnProperty.call(env, "PINOKIO_REGISTRY_CONNECT_ENDPOINT")) {
+        raw = env.PINOKIO_REGISTRY_CONNECT_ENDPOINT
+        source = "env-endpoint"
       }
-    }
-    return ignored
+    } catch (_) {}
+    if (raw == null && process.env.PINOKIO_REGISTRY_CONNECT_URL != null) {
+      raw = process.env.PINOKIO_REGISTRY_CONNECT_URL
+      source = "process-url"
+    } else if (raw == null && process.env.PINOKIO_REGISTRY_CONNECT_ENDPOINT != null) {
+      raw = process.env.PINOKIO_REGISTRY_CONNECT_ENDPOINT
+      source = "process-endpoint"
+    }
+    let value = raw != null ? String(raw).trim() : ""
+    if (!value && this.kernel && this.kernel.store) {
+      const registry = this.kernel.store.get('registry') || {}
+      if (registry.connectUrl) {
+        value = String(registry.connectUrl).trim()
+        if (value) {
+          await this.updateEnvironmentVars({
+            PINOKIO_REGISTRY_CONNECT_URL: value,
+            PINOKIO_REGISTRY_CONNECT_ENDPOINT: ""
+          }).catch(() => {})
+        }
+      }
+    }
+    if (value && source === "env-endpoint") {
+      await this.updateEnvironmentVars({
+        PINOKIO_REGISTRY_CONNECT_URL: value,
+        PINOKIO_REGISTRY_CONNECT_ENDPOINT: ""
+      }).catch(() => {})
+    }
+    return value ? value : null
   }
-  async syncGitInfoExclude(dir, prefixes) {
-    if (!prefixes || prefixes.size === 0) {
-      return
+  async getRegistryViewUrl(hash) {
+    if (!hash) return null
+    const registry = await this.getRegistryConfig().catch(() => ({ url: null, apiKey: null }))
+    const baseUrlRaw = registry && registry.url ? String(registry.url) : ""
+    const baseUrl = baseUrlRaw ? baseUrlRaw.replace(/\/$/, "") : ""
+    const connectUrl = await this.getRegistryConnectUrl().catch(() => null)
+    let uiOrigin = null
+    if (connectUrl) {
+      try {
+        uiOrigin = new URL(connectUrl).origin
+      } catch (_) {}
     }
-
-    const gitdir = path.join(dir, '.git')
-    let gitStats
-    try {
-      gitStats = await fs.promises.stat(gitdir)
-    } catch (error) {
-      return
+    if (!uiOrigin && baseUrlRaw) {
+      try {
+        uiOrigin = new URL(baseUrlRaw).origin
+      } catch (_) {}
     }
-    if (!gitStats.isDirectory()) {
-      return
+    if (!uiOrigin || !baseUrl) return null
+    let appSlug = null
+    try {
+      const res = await axios.get(`${baseUrl}/checkpoints/${encodeURIComponent(String(hash))}`, {
+        headers: { Accept: "application/json" },
+        timeout: 10000,
+      })
+      appSlug = res && res.data && res.data.app && res.data.app.slug ? String(res.data.app.slug) : null
+    } catch (_) {}
+    if (!appSlug) return null
+    const origin = uiOrigin.replace(/\/$/, "")
+    return `${origin}/apps/${encodeURIComponent(appSlug)}/checkpoints/${encodeURIComponent(String(hash))}`
+  }
+  async getSnapshotStatus(name) {
+    let hasSnapshots = false
+    let pendingSnapshotId = null
+    const debugLogs = []
+    const registryBetaEnabled = await this.isRegistryBetaEnabled().catch(() => false)
+    const shouldTreatPending = (entry) => {
+      if (!registryBetaEnabled || !entry || entry.decision) return false
+      const status = entry.sync && entry.sync.status ? String(entry.sync.status) : "local"
+      if (status === "published" || status === "imported") return false
+      return true
     }
-
-    const infoDir = path.join(gitdir, 'info')
-    await fs.promises.mkdir(infoDir, { recursive: true })
-
-    const excludePath = path.join(infoDir, 'exclude')
-    let existing = ''
     try {
-      existing = await fs.promises.readFile(excludePath, 'utf8')
-    } catch (error) {}
-
-    const markerStart = '# >>> pinokiod auto-ignore >>>'
-    const markerEnd = '# <<< pinokiod auto-ignore <<<'
-    const lines = existing.split(/\r?\n/)
-    const preserved = []
-    const managed = new Set()
-    let inBlock = false
-
-    for (const rawLine of lines) {
-      const line = rawLine.trimEnd()
-      if (line === markerStart) {
-        inBlock = true
-        continue
-      }
-      if (line === markerEnd) {
-        inBlock = false
-        continue
-      }
-      if (inBlock) {
-        const entry = rawLine.trim()
-        if (entry && !entry.startsWith('#')) {
-          managed.add(entry)
+      const apiRoot = this.kernel.path("api", name)
+      let remoteKey = null
+      let remoteEntry = null
+      try {
+        const mainRemote = await git.getConfig({
+          fs,
+          http,
+          dir: apiRoot,
+          path: 'remote.origin.url'
+        })
+        if (mainRemote) {
+          remoteKey = this.kernel.git.normalizeRemote(mainRemote)
+          const apps = this.kernel.git && this.kernel.git.history && this.kernel.git.history.apps ? this.kernel.git.history.apps : {}
+          remoteEntry = remoteKey && apps[remoteKey] ? apps[remoteKey] : null
+          debugLogs.push({ stage: "remote-derived", mainRemote, remoteKey, remoteEntryFound: !!remoteEntry })
+        } else {
+          debugLogs.push({ stage: "remote-derived", mainRemote: null })
         }
-        continue
-      }
-      preserved.push(rawLine)
-    }
-
-    const beforeSize = managed.size
-    for (const prefix of prefixes) {
-      if (!prefix) {
-        continue
-      }
-      const normalized = prefix.replace(/\\/g, '/').replace(/\/+/g, '/')
-      if (!normalized || normalized === '.git' || normalized.startsWith('.git/')) {
-        continue
+      } catch (e) {
+        debugLogs.push({ stage: "remote-derived-error", error: e && e.message ? e.message : String(e) })
+      }
+      if (remoteEntry) {
+        const activeRaw = this.kernel.git && this.kernel.git.activeSnapshot && this.kernel.git.activeSnapshot[name]
+        const active = typeof activeRaw === "object" && activeRaw !== null ? activeRaw.id : activeRaw
+        if (active) {
+          hasSnapshots = true
+          debugLogs.push({ stage: "active-snapshot", active })
+          const activeEntry = remoteEntry && Array.isArray(remoteEntry.checkpoints)
+            ? remoteEntry.checkpoints.find((c) => c && String(c.id) === String(active))
+            : null
+          if (activeEntry && activeEntry.decision === "pending") {
+            pendingSnapshotId = String(active)
+          } else if (activeEntry && shouldTreatPending(activeEntry)) {
+            pendingSnapshotId = String(active)
+            await this.kernel.git.setCheckpointDecision(remoteKey, String(active), "pending").catch(() => {})
+          }
+        } else {
+          const repos = await this.kernel.git.repos(apiRoot)
+          const current = []
+          for (const repo of repos) {
+            if (!repo) continue
+            const rel = repo.gitRelPath ? path.dirname(repo.gitRelPath) : null
+            const normalizedPath = rel && rel !== "" && rel !== "." ? rel : "."
+            const repoPath = this.kernel.path("api", name, normalizedPath === "." ? "" : normalizedPath)
+            let commit = null
+            try {
+              const headFile = path.join(repoPath, ".git", "HEAD")
+              const headRefRaw = await fs.promises.readFile(headFile, "utf8").catch(() => null)
+              const headRef = headRefRaw ? headRefRaw.trim() : null
+              if (headRef) {
+                const refMatch = headRef.match(/^ref: (.+)$/)
+                if (refMatch) {
+                  const refPath = path.join(repoPath, ".git", refMatch[1])
+                  const loose = await fs.promises.readFile(refPath, "utf8").catch(() => null)
+                  if (loose && loose.trim()) {
+                    commit = loose.trim()
+                  } else {
+                    // Try packed-refs
+                    try {
+                      const packed = await fs.promises.readFile(path.join(repoPath, ".git", "packed-refs"), "utf8")
+                      const lines = packed.split(/\r?\n/)
+                      for (const line of lines) {
+                        if (!line || line.startsWith('#') || line.startsWith('^')) continue
+                        const [sha, refname] = line.split(' ')
+                        if (refname && refname.trim() === refMatch[1]) {
+                          commit = sha.trim()
+                          break
+                        }
+                      }
+                    } catch (_) {}
+                  }
+                } else {
+                  commit = headRef
+                }
+              }
+            } catch (_) {}
+            current.push({
+              path: normalizedPath,
+              remote: repo && repo.url ? this.kernel.git.canonicalRepoUrl(repo.url) : null,
+              commit
+            })
+          }
+          const snaps = await this.kernel.git.listSnapshotsForRemote(remoteKey)
+          const snapNorm = snaps.map((snap) => this.kernel.git.normalizeReposArray(snap.repos || []))
+          const currNorm = this.kernel.git.normalizeReposArray(current)
+          const matchIndex = snapNorm.findIndex((snapRepos) => JSON.stringify(snapRepos) === JSON.stringify(currNorm))
+          hasSnapshots = matchIndex >= 0
+          if (hasSnapshots) {
+            const matched = snaps[matchIndex]
+            if (matched && matched.decision === "pending" && matched.id != null) {
+              pendingSnapshotId = String(matched.id)
+            } else if (matched && matched.id != null && shouldTreatPending(matched)) {
+              pendingSnapshotId = String(matched.id)
+              await this.kernel.git.setCheckpointDecision(remoteKey, String(matched.id), "pending").catch(() => {})
+            }
+          }
+          debugLogs.push({
+            stage: "compare",
+            current: currNorm,
+            snaps: snapNorm.map((sr, idx) => ({ id: snaps[idx] && snaps[idx].id, repos: sr })),
+            match: hasSnapshots
+          })
+        }
+      } else {
+        hasSnapshots = false
+        debugLogs.push({ stage: "no-remote-entry" })
       }
-      const withSlash = normalized.endsWith('/') ? normalized : `${normalized}/`
-      managed.add(withSlash)
-    }
-
-    if (managed.size === beforeSize && existing.includes(markerStart)) {
-      return
-    }
-
-    const sortedEntries = Array.from(managed)
-      .filter(Boolean)
-      .sort((a, b) => a.localeCompare(b))
-
-    const blocks = []
-    const preservedContent = preserved.join('\n').trimEnd()
-    if (preservedContent) {
-      blocks.push(preservedContent)
-    }
-    if (sortedEntries.length > 0) {
-      blocks.push([markerStart, ...sortedEntries, markerEnd].join('\n'))
+    } catch (_) {}
+    return { hasSnapshots, pendingSnapshotId, debugLogs }
+  }
+  get_shell_id(name, i, rendered) {
+    let shell_id
+    if (rendered.id) {
+      shell_id = encodeURIComponent(`${name}_${rendered.id}`)
+    } else {
+      let hash = crypto.createHash('md5').update(JSON.stringify(rendered)).digest('hex')
+      //shell_id = encodeURIComponent(`${name}_${i}_session_${hash}`)
+      shell_id = encodeURIComponent(`${name}_session_${hash}`)
     }
-
-    const finalContent = blocks.join('\n\n')
-    await fs.promises.writeFile(excludePath, finalContent ? `${finalContent}\n` : '', 'utf8')
+    return shell_id
+  }
+  is_subpath(parent, child) {
+    const relative = path.relative(parent, child);
+    let check = !!relative && !relative.startsWith('..') && !path.isAbsolute(relative);
+    return check
   }
   async getRepoHeadStatus(repoRelPath) {
     const repoParam = repoRelPath || ""
@@ -1379,123 +1413,175 @@ class Server {
       return { changes: [], git_commit_url: null }
     }
 
-
-    const normalizePath = (p) => p.replace(/\\/g, '/').replace(/\/+/g, '/')
-    const ignoredPrefixes = await this.discoverVirtualEnvDirs(dir)
-
-    const shouldIncludePath = (relativePath) => {
-      if (!relativePath) {
-        return true
-      }
-      const normalized = normalizePath(relativePath)
-      if (this.gitStatusIgnorePatterns && this.gitStatusIgnorePatterns.some((regex) => regex.test(normalized) || regex.test(`${normalized}/`))) {
-        return false
-      }
-      for (const prefix of ignoredPrefixes) {
-        if (normalized === prefix || normalized.startsWith(`${prefix}/`)) {
-          return false
+      let gitIgnoreEngine = null
+      let workspaceName = null
+      let workspaceRelBase = ''
+      try {
+        if (this.workspaceStatus && this.kernel && typeof this.kernel.path === 'function') {
+          if (repoParam && repoParam.length > 0) {
+            const parts = repoParam.split('/')
+            workspaceName = parts[0]
+            const workspaceRoot = this.kernel.path("api", workspaceName)
+            await this.workspaceStatus.ensureGitIgnoreEngine(workspaceName, workspaceRoot)
+            gitIgnoreEngine = this.workspaceStatus.gitIgnoreEngines && this.workspaceStatus.gitIgnoreEngines.get
+              ? this.workspaceStatus.gitIgnoreEngines.get(workspaceName) || null
+              : null
+            if (parts.length > 1) {
+              workspaceRelBase = parts.slice(1).join('/')
+            }
+          }
         }
+      } catch (_) {
       }
-      if (normalized.includes('/site-packages/')) {
-        return false
-      }
-      if (normalized.includes('/Scripts/')) {
-        return false
-      }
-      if (normalized.includes('/bin/activate')) {
-        return false
-      }
-      return true
-    }
-
-    let statusMatrix = await git.statusMatrix({ dir, fs })
-    statusMatrix = statusMatrix.filter(Boolean)
 
-    let headOid = null
-    const getHeadOid = async () => {
-      if (headOid) return headOid
-      headOid = await git.resolveRef({ fs, dir, ref: 'HEAD' })
-      return headOid
-    }
-    const readNormalized = async (source, filepath) => {
-      if (source === 'head') {
-        const oid = await getHeadOid()
-        const { blob } = await git.readBlob({ fs, dir, oid, filepath })
-        return normalize(Buffer.from(blob).toString('utf8'))
-      } else {
-        const content = await fs.promises.readFile(path.join(dir, filepath), 'utf8')
-        return normalize(content)
+      const normalizePath = (p) => p.replace(/\\/g, '/').replace(/\/+/g, '/')
+      const shouldIncludePath = (relativePath) => {
+        if (!relativePath) {
+          return true
+        }
+        const normalized = normalizePath(relativePath)
+        if (this.gitStatusIgnorePatterns && this.gitStatusIgnorePatterns.some((regex) => regex.test(normalized) || regex.test(`${normalized}/`))) {
+          return false
+        }
+        if (normalized.includes('/site-packages/')) {
+          return false
+        }
+        if (normalized.includes('/Scripts/')) {
+          return false
+        }
+        if (normalized.includes('/bin/activate')) {
+          return false
+        }
+        return true
       }
-    }
 
-    const changes = []
-    for (const [filepath, head, workdir, stage] of statusMatrix) {
-      if (!shouldIncludePath(filepath)) {
-        continue
-      }
-      if (head === workdir && head === stage) {
-        continue
-      }
-      const absolutePath = path.join(dir, filepath)
-      let stats
+      let stdout = ""
       try {
-        stats = await fs.promises.stat(absolutePath)
+        const env = this.kernel && this.kernel.envs
+          ? this.kernel.envs
+          : (this.kernel && this.kernel.bin && typeof this.kernel.bin.envs === 'function'
+              ? this.kernel.bin.envs(process.env)
+              : process.env)
+        stdout = await new Promise((resolve) => {
+          execFile(
+            'git',
+            ['status', '--porcelain=v1', '--untracked-files=all'],
+            {
+              cwd: dir,
+              env,
+              maxBuffer: 10 * 1024 * 1024,
+            },
+            (err, out) => {
+              if (err) {
+                console.warn('[git] status failed', dir, err && err.message ? err.message : err)
+                resolve("")
+                return
+              }
+              resolve(out || "")
+            }
+          )
+        })
       } catch (error) {
-        stats = null
-      }
-      if (stats && stats.isDirectory()) {
-        continue
+        console.warn('[git] status threw', dir, error && error.message ? error.message : error)
+        stdout = ""
       }
+      const lines = stdout.split(/\r?\n/).filter((line) => line && line.trim().length > 0)
 
-      const status = Util.classifyChange(head, workdir, stage)
-      if (!status) {
-        continue
-      }
-
-      // Skip entries where HEAD and worktree match after normalization
-      if (status && status.startsWith('modified')) {
-        try {
-          const headContent = await readNormalized('head', filepath)
-          const worktreeContent = await readNormalized('worktree', filepath)
-          if (headContent === worktreeContent) {
+      const changes = []
+      for (const line of lines) {
+        if (line.length < 3) {
+          continue
+        }
+        const x = line[0]
+        const y = line[1]
+        if (x === '!' && y === '!') {
+          continue
+        }
+        let rest = line.slice(3)
+        let filepath
+        const renameIdx = rest.indexOf(' -> ')
+        if (renameIdx !== -1) {
+          filepath = rest.slice(renameIdx + 4)
+        } else {
+          filepath = rest
+        }
+        if (!filepath) {
+          continue
+        }
+        if (gitIgnoreEngine && workspaceName) {
+          const workspaceRelative = workspaceRelBase ? `${workspaceRelBase}/${filepath}` : filepath
+          const normalizedWorkspaceRel = normalizePath(workspaceRelative)
+          if (gitIgnoreEngine.ignores(normalizedWorkspaceRel)) {
             continue
           }
-        } catch (_) {
-          // fall through if comparison fails
         }
-      }
+        if (!shouldIncludePath(filepath)) {
+          continue
+        }
+        const normalizedFile = normalizePath(filepath)
+        const absolutePath = path.join(dir, filepath)
+        let stats
+        try {
+          stats = await fs.promises.stat(absolutePath)
+        } catch (error) {
+          stats = null
+        }
+        if (stats && stats.isDirectory()) {
+          continue
+        }
+
+        let status
+        if (x === '?' && y === '?') {
+          status = 'new (untracked)'
+        } else if (x === 'R' || y === 'R') {
+          status = 'renamed'
+        } else if (x === 'C' || y === 'C') {
+          status = 'copied'
+        } else if (x === 'A' || y === 'A') {
+          status = 'added (staged)'
+        } else if (x === 'D' || y === 'D') {
+          status = 'deleted'
+        } else if (x === 'M' || y === 'M') {
+          if (x === 'M' && y === 'M') {
+            status = 'modified (staged + unstaged)'
+          } else if (x === 'M') {
+            status = 'modified (staged)'
+          } else {
+            status = 'modified (unstaged)'
+          }
+        } else {
+          status = `unknown (${x}${y})`
+        }
 
-      const webpath = "/asset/" + path.relative(this.kernel.homedir, absolutePath)
+        const webpath = "/asset/" + path.relative(this.kernel.homedir, absolutePath)
 
-      changes.push({
-        ref: 'HEAD',
-        webpath,
-        file: normalizePath(filepath),
-        path: absolutePath,
-        diffpath: `/gitdiff/HEAD/${repoParam}/${normalizePath(filepath)}`,
-        status,
-      })
-    }
+        changes.push({
+          ref: 'HEAD',
+          webpath,
+          file: normalizedFile,
+          path: absolutePath,
+          diffpath: `/gitdiff/HEAD/${repoParam}/${normalizedFile}`,
+          status,
+        })
+      }
 
-    const repoHistoryUrl = repoParam ? `/info/git/HEAD/${repoParam}` : null
+      const repoHistoryUrl = repoParam ? `/info/git/HEAD/${repoParam}` : null
 
-    const forkUrl = `/run/scripts/git/fork.json?cwd=${encodeURIComponent(dir)}`
-    const pushUrl = `/run/scripts/git/push.json?cwd=${encodeURIComponent(dir)}`
+      const forkUrl = `/run/scripts/git/fork.json?cwd=${encodeURIComponent(dir)}`
+      const pushUrl = `/run/scripts/git/push.json?cwd=${encodeURIComponent(dir)}`
 
-    return {
-      changes,
-      git_commit_url: `/run/scripts/git/commit.json?cwd=${dir}&callback_target=parent&callback=$location.href`,
-      git_history_url: repoHistoryUrl,
-      git_fork_url: forkUrl,
-      git_push_url: pushUrl,
-    }
+      return {
+        changes,
+        git_commit_url: `/run/scripts/git/commit.json?cwd=${dir}&callback_target=parent&callback=$location.href`,
+        git_history_url: repoHistoryUrl,
+        git_fork_url: forkUrl,
+        git_push_url: pushUrl,
+      }
   }
   async computeWorkspaceGitStatus(workspaceName) {
     const workspacePath = this.kernel.path("api", workspaceName)
     const repos = await this.kernel.git.repos(workspacePath)
 
-//    await Util.ignore_subrepos(workspacePath, repos)
-
     const statuses = []
     for (const repo of repos) {
       const repoParam = repo.gitParentRelPath || workspaceName
@@ -4240,6 +4326,7 @@ class Server {
         let str = await Environment.ENV("system", this.kernel.homedir, this.kernel)
         await fs.promises.writeFile(path.resolve(this.kernel.homedir, "ENVIRONMENT"), str)
       }
+      this.workspaceStatus.ensureWatcher('api', this.kernel.path('api')).catch(() => {})
     }
 
 
@@ -4523,6 +4610,634 @@ class Server {
         list,
       })
     }))
+    this.app.get("/checkpoints", ex(async (req, res) => {
+      const registryBetaEnabled = await this.isRegistryBetaEnabled().catch(() => false)
+      const peerAccess = await this.composePeerAccessPayload()
+      const list = this.getPeers()
+      const history = this.kernel.git && this.kernel.git.history ? this.kernel.git.history : { version: "1", apps: {} }
+
+	      const normalizeSha256Digest = (raw) => {
+	        if (!raw) return null
+	        const str = String(raw).trim()
+	        if (!str) return null
+	        const m = str.match(/^sha256:([0-9a-f]{64})$/i)
+	        if (m) return `sha256:${m[1].toLowerCase()}`
+        const m2 = str.match(/^([0-9a-f]{64})$/i)
+        if (m2) return `sha256:${m2[1].toLowerCase()}`
+        return null
+      }
+
+      const importHash = normalizeSha256Digest(typeof req.query.hash === "string" ? req.query.hash : "")
+      const importRegistryRaw = typeof req.query.registry === "string" ? req.query.registry.trim() : ""
+      let autoInstall = null
+      let importError = null
+      if (importHash) {
+        let registryUrl = importRegistryRaw
+        if (!registryUrl) {
+	          try {
+	            const registry = await this.getRegistryConfig()
+	            registryUrl = registry && registry.url ? String(registry.url) : ""
+	          } catch (_) {}
+        }
+	        registryUrl = (registryUrl || "").replace(/\/$/, "")
+	        if (!registryUrl) {
+	          importError = "Missing registry URL"
+	        } else {
+
+	          try {
+	            const response = await axios.get(`${registryUrl}/checkpoints/${encodeURIComponent(importHash)}`, {
+	              headers: { Accept: "application/json" },
+	              timeout: 15000,
+	            })
+	            const detail = response && response.data ? response.data : null
+	            const checkpoint = detail && detail.checkpoint && typeof detail.checkpoint === "object" ? detail.checkpoint : null
+	            if (!checkpoint) throw new Error("Invalid checkpoint payload")
+
+          const hashed = this.kernel.git.hashCheckpoint(checkpoint)
+          if (!hashed || !hashed.canonical || !hashed.digest) throw new Error("Invalid checkpoint payload")
+          if (String(hashed.digest) !== importHash) throw new Error("Checkpoint hash mismatch")
+
+          // Persist commit metadata (subject/authorName/committedAt) returned by the registry for richer UI.
+          const commitInfo = detail && detail.commitInfo && typeof detail.commitInfo === "object" ? detail.commitInfo : null
+          if (commitInfo && hashed.canonical && Array.isArray(hashed.canonical.repos)) {
+            for (const repo of hashed.canonical.repos) {
+              if (!repo || !repo.repo || !repo.commit) continue
+              const key = `${repo.repo}@${repo.commit}`
+              const info = commitInfo[key]
+              if (!info || typeof info !== "object") continue
+              try {
+                this.kernel.git.upsertCommitMeta(repo.repo, repo.commit, {
+                  subject: info.subject || null,
+                  authorName: info.authorName || null,
+                  committedAt: info.committedAt || null,
+                })
+              } catch (_) {}
+            }
+          }
+
+          const rootRemote = hashed.canonical.root
+          const remoteEntry = this.kernel.git.ensureApp(rootRemote)
+          if (!remoteEntry) throw new Error("Invalid checkpoint root")
+          const { remoteKey, entry } = remoteEntry
+
+          let snapshotId = null
+          if (entry && Array.isArray(entry.checkpoints)) {
+            const existing = entry.checkpoints.find((c) => c && String(c.hash) === importHash && c.id != null)
+            if (existing) snapshotId = String(existing.id)
+          }
+
+          if (!snapshotId) {
+            snapshotId = String(Date.now())
+            await this.kernel.git.writeCheckpointPayload(remoteKey, rootRemote, {
+              checkpoint: hashed.canonical,
+              id: snapshotId,
+              visibility: "public",
+              system: null,
+            })
+          } else {
+            const filePath = this.kernel.git.checkpointFilePath(importHash)
+            if (filePath) {
+              try {
+                await fs.promises.access(filePath, fs.constants.F_OK)
+              } catch (_) {
+                await fs.promises.mkdir(path.dirname(filePath), { recursive: true }).catch(() => {})
+                await fs.promises.writeFile(filePath, JSON.stringify(hashed.canonical, null, 2))
+              }
+            }
+          }
+
+	            await this.kernel.git.setCheckpointSync(remoteKey, snapshotId, {
+	              status: "imported",
+	              at: Date.now(),
+	              source: registryUrl,
+	              hash: importHash,
+	            }).catch(() => {})
+	            autoInstall = { remoteKey, snapshotId, hash: importHash }
+	          } catch (err) {
+	            importError = err && err.message ? err.message : String(err)
+	          }
+	        }
+	      }
+
+      const apps = history && history.apps ? history.apps : {}
+      const apiRoot = this.kernel.path("api")
+      const checkpointsDir = (this.kernel && this.kernel.git && typeof this.kernel.git.checkpointsDir === "function")
+        ? this.kernel.git.checkpointsDir()
+        : null
+      const foldersByRemote = {}
+      try {
+        const entries = await fs.promises.readdir(apiRoot, { withFileTypes: true })
+        for (const entry of entries) {
+          if (!entry || !entry.isDirectory()) continue
+          const folderName = entry.name
+          const workspaceRoot = this.kernel.path("api", folderName)
+          let remote = null
+          try {
+            remote = await git.getConfig({
+              fs,
+              http,
+              dir: workspaceRoot,
+              path: 'remote.origin.url'
+            })
+          } catch (_) {}
+          if (!remote) continue
+          let headHash = null
+          try {
+            const head = await this.kernel.git.getHead(workspaceRoot)
+            headHash = head && head.hash ? head.hash : null
+          } catch (_) {}
+          const remoteKey = this.kernel.git.normalizeRemote(remote)
+          if (!remoteKey) continue
+          if (!foldersByRemote[remoteKey]) foldersByRemote[remoteKey] = []
+          foldersByRemote[remoteKey].push({ name: folderName, head: headHash })
+        }
+      } catch (_) {}
+      const items = []
+      for (const [remoteKey, entry] of Object.entries(apps)) {
+        const folders = Array.isArray(foldersByRemote[remoteKey])
+          ? foldersByRemote[remoteKey].slice().sort((a, b) => a.name.localeCompare(b.name))
+          : []
+        const snapshots = await this.kernel.git.listSnapshotsForRemote(remoteKey)
+        const installedBySnapshot = {}
+        for (const snap of snapshots) {
+          const mainRepo = snap.repos.find((repo) => repo && repo.path === ".")
+          if (!mainRepo || !mainRepo.commit) continue
+          const matches = folders.filter((f) => f.head && f.head === mainRepo.commit).map((f) => f.name)
+          if (matches.length > 0) {
+            installedBySnapshot[snap.id] = matches
+          }
+        }
+        let icon = null
+        let title = null
+        let description = ""
+        if (this.kernel && this.kernel.api && typeof this.kernel.api.meta === "function") {
+          for (const snap of snapshots) {
+            const installedFolders = installedBySnapshot[snap.id]
+            if (installedFolders && installedFolders.length > 0) {
+              const folderName = installedFolders[0]
+              try {
+                const meta = await this.kernel.api.meta(folderName)
+                if (meta && typeof meta === "object") {
+                  if (meta.icon) {
+                    icon = meta.icon
+                  }
+                  if (typeof meta.title === "string" && meta.title.trim()) {
+                    title = meta.title.trim()
+                  }
+                  if (typeof meta.description === "string" && meta.description.trim()) {
+                    description = meta.description.trim()
+                  }
+                }
+              } catch (_) {}
+              break
+            }
+          }
+        }
+        items.push({
+          remoteKey,
+          remoteUrl: entry.remote || remoteKey,
+          displayName: entry.remote || remoteKey,
+          folders,
+          snapshots,
+          installedBySnapshot,
+          icon,
+          title,
+          description,
+        })
+      }
+      items.sort((a, b) => a.displayName.localeCompare(b.displayName))
+      res.render("checkpoints", {
+        current_host: this.kernel.peer.host,
+        ...peerAccess,
+        history,
+        items,
+        autoInstall,
+        importError,
+        checkpointsDir,
+        registryBetaEnabled,
+        portal: this.portal,
+        logo: this.logo,
+        theme: this.theme,
+        agent: req.agent,
+        list,
+      })
+    }))
+    this.app.get("/checkpoints/registry_beta", ex(async (req, res) => {
+      const registryBetaEnabled = await this.isRegistryBetaEnabled().catch(() => false)
+      const registryConnectUrl = await this.getRegistryConnectUrl().catch(() => null)
+      const registryUrlPrefill = typeof req.query.registry_url === "string" ? req.query.registry_url.trim() : ""
+      res.render("checkpoints_registry_beta", {
+        registryBetaEnabled,
+        registryConnectUrl,
+        registryUrlPrefill,
+        theme: this.theme,
+        agent: req.agent,
+      })
+    }))
+
+	    // Registry linking endpoint
+		    this.app.get("/registry/link", ex(async (req, res) => {
+		      const { token, registry, app: appOrigin, next: nextRaw } = req.query
+	
+	      if (!token || !registry) {
+	        res.status(400).render("registry_link", {
+	          ok: false,
+	          message: "Missing token or registry parameters",
+	          registryUrl: registry ? String(registry) : null,
+	        })
+	        return
+	      }
+	
+		      const registryUrl = String(registry)
+	      let connectUrl = null
+	      let redirectUrl = null
+	      try {
+	        if (appOrigin) {
+	          const u = new URL(String(appOrigin))
+	          u.pathname = "/connect/pinokio"
+	          u.search = ""
+	          u.hash = ""
+		          connectUrl = u.toString().replace(/\/$/, "")
+		        }
+		      } catch (_) {}
+
+	      if (connectUrl) {
+	        try {
+	          const u = new URL(connectUrl)
+	          u.searchParams.set("linked", "1")
+	          redirectUrl = u.toString()
+	        } catch (_) {}
+	      }
+
+	      if (appOrigin && nextRaw) {
+	        try {
+	          const base = new URL(String(appOrigin))
+	          const nextVal = String(nextRaw)
+	          const candidate = new URL(nextVal, base.toString())
+	          if (candidate.origin === base.origin) redirectUrl = candidate.toString()
+	        } catch (_) {}
+	      }
+	
+	      try {
+	        // Exchange token for API key at the specified registry
+	        const response = await axios.post(
+	          `${registryUrl}/registry/exchange`,
+	          { token: String(token) },
+	          { headers: { 'Content-Type': 'application/json' } }
+	        )
+	
+	        const { apiKey, registryUrl: confirmedUrl } = response.data
+
+	        const envUpdates = {
+	          PINOKIO_REGISTRY_API_KEY: apiKey,
+	          PINOKIO_REGISTRY_URL: confirmedUrl || registryUrl
+	        }
+	        if (connectUrl) {
+	          envUpdates.PINOKIO_REGISTRY_CONNECT_URL = connectUrl
+	          envUpdates.PINOKIO_REGISTRY_CONNECT_ENDPOINT = ""
+	        }
+	        await this.updateEnvironmentVars(envUpdates)
+	
+	        if (redirectUrl) {
+	          res.redirect(redirectUrl)
+	          return
+	        }
+	
+	        res.render("registry_link", { ok: true, registryUrl: confirmedUrl || registryUrl })
+	      } catch (error) {
+	        console.log("Error", error)
+	        if (connectUrl) {
+	          try {
+	            const u = new URL(connectUrl)
+	            u.searchParams.set("error", "1")
+	            const msg = error && error.message ? String(error.message) : String(error)
+	            u.searchParams.set("message", msg.slice(0, 240))
+	            res.redirect(u.toString())
+	            return
+	          } catch (_) {}
+	        }
+	        res.status(500).render("registry_link", {
+	          ok: false,
+	          message: error && error.message ? error.message : String(error),
+	          registryUrl,
+	        })
+	      }
+	    }))
+
+    this.app.get("/api/registry/status", ex(async (req, res) => {
+      const registry = await this.getRegistryConfig()
+      const baseUrl = registry && registry.url ? String(registry.url).replace(/\/$/, '') : null
+      const apiKey = registry && registry.apiKey ? String(registry.apiKey) : null
+      res.json({ linked: !!apiKey, url: baseUrl })
+    }))
+
+    this.app.post("/checkpoints/registry_beta", ex(async (req, res) => {
+      const rawValue = Object.prototype.hasOwnProperty.call(req.body || {}, "enabled")
+        ? req.body.enabled
+        : (Object.prototype.hasOwnProperty.call(req.query || {}, "enabled") ? req.query.enabled : null)
+      const hasConnectField = Object.prototype.hasOwnProperty.call(req.body || {}, "connectUrl")
+        || Object.prototype.hasOwnProperty.call(req.body || {}, "connectEndpoint")
+        || Object.prototype.hasOwnProperty.call(req.body || {}, "registry_url")
+        || Object.prototype.hasOwnProperty.call(req.query || {}, "connectUrl")
+        || Object.prototype.hasOwnProperty.call(req.query || {}, "connectEndpoint")
+        || Object.prototype.hasOwnProperty.call(req.query || {}, "registry_url")
+      const connectRaw = Object.prototype.hasOwnProperty.call(req.body || {}, "connectUrl")
+        ? req.body.connectUrl
+        : (Object.prototype.hasOwnProperty.call(req.body || {}, "registry_url")
+          ? req.body.registry_url
+          : (Object.prototype.hasOwnProperty.call(req.body || {}, "connectEndpoint")
+            ? req.body.connectEndpoint
+            : (Object.prototype.hasOwnProperty.call(req.query || {}, "connectUrl")
+              ? req.query.connectUrl
+              : (Object.prototype.hasOwnProperty.call(req.query || {}, "registry_url")
+                ? req.query.registry_url
+                : (Object.prototype.hasOwnProperty.call(req.query || {}, "connectEndpoint")
+                  ? req.query.connectEndpoint
+                  : null)))))
+      const connectUrl = connectRaw != null ? String(connectRaw).trim() : ""
+      const parsed = this.parseRegistryBetaValue(rawValue)
+      if (parsed == null) {
+        res.status(400).json({ ok: false, error: "Invalid enabled value" })
+        return
+      }
+      const updates = {
+        PINOKIO_REGISTRY_BETA: parsed ? "1" : ""
+      }
+      if (hasConnectField) {
+        updates.PINOKIO_REGISTRY_CONNECT_URL = connectUrl
+        updates.PINOKIO_REGISTRY_CONNECT_ENDPOINT = ""
+      }
+      await this.updateEnvironmentVars(updates)
+      res.json({ ok: true, enabled: parsed, connectUrl: connectUrl || null })
+    }))
+
+		    this.app.post("/checkpoints/publish", ex(async (req, res) => {
+      const registryBetaEnabled = await this.isRegistryBetaEnabled().catch(() => false)
+      if (!registryBetaEnabled) {
+        res.status(404).json({ ok: false, error: "Not found" })
+        return
+      }
+	      const snapshotRaw = typeof req.query.snapshotId === 'string' || typeof req.query.snapshotId === 'number' ? req.query.snapshotId : ''
+	      const snapshotId = snapshotRaw === 'latest' ? 'latest' : String(snapshotRaw || '')
+	      if (!snapshotId) {
+	        res.status(400).json({ ok: false, error: "Missing snapshotId" })
+        return
+      }
+      const payload = await this.kernel.git.readCheckpointPayload(snapshotId)
+      if (!payload || !payload.app || !payload.hash) {
+        res.status(404).json({ ok: false, error: "Snapshot not found" })
+        return
+      }
+
+	      const registry = await this.getRegistryConfig()
+	      const baseUrl = registry && registry.url ? String(registry.url).replace(/\/$/, '') : null
+	      const apiKey = registry && registry.apiKey ? String(registry.apiKey) : null
+	      const connectUrl = await this.getRegistryConnectUrl().catch(() => null)
+		
+		      if (!baseUrl || !apiKey) {
+		        await this.kernel.git.setCheckpointSync(payload.app, snapshotId, { status: "needs_link", at: Date.now() }).catch(() => {})
+		        res.json({ ok: true, publish: { ok: false, code: "not_linked", connectUrl } })
+		        return
+		      }
+
+      try {
+        await this.kernel.git.setCheckpointSync(payload.app, snapshotId, { status: "syncing", at: Date.now() })
+        const filePath = this.kernel.git.checkpointFilePath(payload.hash)
+        const checkpoint = filePath ? JSON.parse(await fs.promises.readFile(filePath, "utf8")) : null
+        const system = payload.system && typeof payload.system === "object" ? payload.system : {
+          platform: payload.platform || null,
+          arch: payload.arch || null,
+          gpu: payload.gpu || null,
+          ram: typeof payload.ram === "number" ? payload.ram : null,
+          vram: typeof payload.vram === "number" ? payload.vram : null,
+        }
+	        const response = await axios.post(
+	          `${baseUrl}/checkpoints`,
+	          {
+	            hash: String(payload.hash),
+	            visibility: "public",
+	            checkpoint,
+	            system,
+	          },
+	          { headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}` } }
+	        )
+	        const remoteId = response && response.data
+	          ? (response.data.checkpoint && response.data.checkpoint.id ? response.data.checkpoint.id : (response.data.id ? response.data.id : null))
+	          : null
+          const viewUrl = await this.getRegistryViewUrl(payload.hash)
+	        await this.kernel.git.setCheckpointSync(payload.app, snapshotId, { status: "published", at: Date.now(), remoteId })
+	        await this.kernel.git.setCheckpointDecision(payload.app, snapshotId, "published").catch(() => {})
+	        res.json({ ok: true, publish: { ok: true, remoteId, hash: payload.hash, url: viewUrl } })
+	      } catch (error) {
+	        const status = error && error.response && error.response.status ? Number(error.response.status) : null
+	        const message = error && error.message ? error.message : String(error)
+		        if (status === 401 || status === 403) {
+		          await this.updateEnvironmentVars({ PINOKIO_REGISTRY_API_KEY: "" }).catch(() => {})
+		          await this.kernel.git.setCheckpointSync(payload.app, snapshotId, { status: "needs_link", at: Date.now(), error: message }).catch(() => {})
+		          res.json({ ok: true, publish: { ok: false, code: "not_linked", connectUrl } })
+		          return
+		        }
+	        await this.kernel.git.setCheckpointSync(payload.app, snapshotId, { status: "error", at: Date.now(), error: message }).catch(() => {})
+	        res.json({ ok: true, publish: { ok: false, code: "error", error: message } })
+	      }
+	    }))
+
+	    this.app.post("/checkpoints/decision", ex(async (req, res) => {
+      const registryBetaEnabled = await this.isRegistryBetaEnabled().catch(() => false)
+      if (!registryBetaEnabled) {
+        res.status(404).json({ ok: false, error: "Not found" })
+        return
+      }
+	      const snapshotRaw = typeof req.query.snapshotId === 'string' || typeof req.query.snapshotId === 'number' ? req.query.snapshotId : ''
+	      const snapshotId = snapshotRaw === 'latest' ? 'latest' : String(snapshotRaw || '')
+	      const decisionRaw = typeof req.query.decision === 'string' ? req.query.decision.trim().toLowerCase() : ''
+	      if (!snapshotId || !decisionRaw) {
+	        res.status(400).json({ ok: false, error: "Missing parameters" })
+	        return
+	      }
+	      if (decisionRaw !== "later") {
+	        res.status(400).json({ ok: false, error: "Invalid decision" })
+	        return
+	      }
+	      const payload = await this.kernel.git.readCheckpointPayload(snapshotId)
+	      if (!payload || !payload.app) {
+	        res.status(404).json({ ok: false, error: "Snapshot not found" })
+	        return
+	      }
+	      const ok = await this.kernel.git.setCheckpointDecision(payload.app, snapshotId, decisionRaw)
+	      res.json({ ok: !!ok })
+	    }))
+
+	    this.app.post("/checkpoints/snapshot", ex(async (req, res) => {
+      const name = typeof req.query.workspace === 'string' ? req.query.workspace.trim() : ''
+      if (!name) {
+        res.json({ ok: false })
+        return
+      }
+      const registryBetaEnabled = await this.isRegistryBetaEnabled().catch(() => false)
+      const publishRaw = typeof req.query.publish === 'string' ? req.query.publish.trim().toLowerCase() : ''
+      const wantPublish = registryBetaEnabled && (publishRaw === '1' || publishRaw === 'true' || publishRaw === 'cloud')
+      const root = this.kernel.path("api", name)
+	      const repos = await this.kernel.git.repos(root)
+	      const created = await this.kernel.git.appendWorkspaceSnapshot(name, repos)
+	      if (registryBetaEnabled && created && created.remoteKey && created.id) {
+	        const existingDecision = this.kernel.git.getCheckpointDecision(created.remoteKey, created.id)
+	        if (!existingDecision) {
+	          await this.kernel.git.setCheckpointDecision(created.remoteKey, created.id, "pending").catch(() => {})
+	        }
+	      }
+	      if (created && created.remoteKey && created.id && created.hash) {
+	        if (wantPublish) {
+	          const registry = await this.getRegistryConfig()
+	          const baseUrl = registry && registry.url ? String(registry.url).replace(/\/$/, '') : null
+	          const apiKey = registry && registry.apiKey ? String(registry.apiKey) : null
+	          const connectUrl = await this.getRegistryConnectUrl().catch(() => null)
+	          if (!baseUrl || !apiKey) {
+	            await this.kernel.git.setCheckpointSync(created.remoteKey, created.id, { status: "needs_link", at: Date.now() }).catch(() => {})
+	            res.json({ ok: true, created: created || null, publish: { ok: false, code: "not_linked", connectUrl } })
+	            return
+	          }
+          try {
+            await this.kernel.git.setCheckpointSync(created.remoteKey, created.id, { status: "syncing", at: Date.now() })
+            const snapshot = await this.kernel.git.readCheckpointPayload(created.id)
+            const filePath = this.kernel.git.checkpointFilePath(created.hash)
+            const checkpoint = filePath ? JSON.parse(await fs.promises.readFile(filePath, "utf8")) : null
+            const system = snapshot && snapshot.system && typeof snapshot.system === "object" ? snapshot.system : null
+	            const response = await axios.post(
+	              `${baseUrl}/checkpoints`,
+	              {
+	                hash: String(created.hash),
+	                visibility: "public",
+	                checkpoint,
+	                system,
+	              },
+	              { headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}` } }
+	            )
+	            const remoteId = response && response.data
+	              ? (response.data.checkpoint && response.data.checkpoint.id ? response.data.checkpoint.id : (response.data.id ? response.data.id : null))
+	              : null
+              const viewUrl = await this.getRegistryViewUrl(created.hash)
+	            await this.kernel.git.setCheckpointSync(created.remoteKey, created.id, { status: "published", at: Date.now(), remoteId })
+	            await this.kernel.git.setCheckpointDecision(created.remoteKey, created.id, "published").catch(() => {})
+	            res.json({ ok: true, created: created || null, publish: { ok: true, remoteId, hash: created.hash, url: viewUrl } })
+	            return
+	          } catch (error) {
+	            const status = error && error.response && error.response.status ? Number(error.response.status) : null
+	            const message = error && error.message ? error.message : String(error)
+		            if (status === 401 || status === 403) {
+		              await this.updateEnvironmentVars({ PINOKIO_REGISTRY_API_KEY: "" }).catch(() => {})
+		              await this.kernel.git.setCheckpointSync(created.remoteKey, created.id, { status: "needs_link", at: Date.now(), error: message }).catch(() => {})
+		              res.json({ ok: true, created: created || null, publish: { ok: false, code: "not_linked", connectUrl } })
+		              return
+		            }
+	            await this.kernel.git.setCheckpointSync(created.remoteKey, created.id, { status: "error", at: Date.now(), error: message }).catch(() => {})
+	            res.json({ ok: true, created: created || null, publish: { ok: false, code: "error", error: message } })
+	            return
+	          }
+	        }
+	      }
+      res.json({ ok: true, created: created || null })
+    }))
+    this.app.post("/checkpoints/install", ex(async (req, res) => {
+      const remote = typeof req.body.remote === 'string' ? req.body.remote.trim() : ''
+      const folder = typeof req.body.folder === 'string' ? req.body.folder.trim() : ''
+      const snapshotRaw = typeof req.body.snapshotId === 'string' || typeof req.body.snapshotId === 'number' ? req.body.snapshotId : ''
+      const snapshotId = snapshotRaw === 'latest' ? 'latest' : String(snapshotRaw)
+      if (!remote || !folder || (!snapshotRaw && snapshotRaw !== 0)) {
+        res.status(400).json({ ok: false, error: "Missing parameters" })
+        return
+      }
+      if (folder.includes('/') || folder.includes('\\')) {
+        res.status(400).json({ ok: false, error: "Invalid folder name" })
+        return
+      }
+      const apiRoot = this.kernel.path("api")
+      const targetPath = this.kernel.path("api", folder)
+      let exists = false
+      try {
+        await fs.promises.access(targetPath, fs.constants.F_OK)
+        exists = true
+      } catch (_) {}
+      if (exists) {
+        res.json({ ok: false, code: "exists", error: "Folder already exists" })
+        return
+      }
+      await fs.promises.mkdir(apiRoot, { recursive: true }).catch(() => {})
+      if (snapshotId === 'latest') {
+        const safeRemote = remote.replace(/"/g, '\\"')
+        try {
+          await this.kernel.exec({
+            message: [`git clone "${safeRemote}" "${folder}"`],
+            path: apiRoot
+          }, () => {})
+        } catch (err) {
+          await fs.promises.rm(targetPath, { recursive: true, force: true }).catch(() => {})
+          res.json({ ok: false, error: err && err.message ? err.message : 'Clone failed' })
+          return
+        }
+        res.json({ ok: true, redirect: `/p/${encodeURIComponent(folder)}` })
+        return
+      }
+      if (snapshotId !== 'latest' && String(snapshotId).trim() === "") {
+        res.status(400).json({ ok: false, error: "Invalid snapshot" })
+        return
+      }
+      const found = await this.kernel.git.findSnapshotByRemote(remote, snapshotId)
+      if (!found || !found.snapshot) {
+        res.status(404).json({ ok: false, error: "Snapshot not found" })
+        return
+      }
+      const { remoteKey, snapshot } = found
+      let addedSnapshot = false
+      let ok = false
+      try {
+        ok = await this.kernel.git.downloadMainFromSnapshot(folder, snapshot.id, remote)
+      } catch (_) {
+        ok = false
+      }
+      if (!ok) {
+        await fs.promises.rm(targetPath, { recursive: true, force: true }).catch(() => {})
+        res.json({ ok: false, error: "Failed to download snapshot" })
+        return
+      }
+      if (this.kernel.git && this.kernel.git.activeSnapshot) {
+        this.kernel.git.activeSnapshot[folder] = { id: snapshot.id, remoteKey }
+      }
+      res.json({ ok: true, redirect: `/p/${encodeURIComponent(folder)}` })
+    }))
+    this.app.get("/checkpoints/restore/:workspace/:snapshotId", ex(async (req, res) => {
+      const workspace = typeof req.params.workspace === 'string' ? req.params.workspace : ''
+      const snapshotId = req.params.snapshotId
+      const ok = await this.kernel.git.downloadMainFromSnapshot(workspace, snapshotId)
+      if (ok) {
+        // Mark this workspace as being in "restore from snapshot" mode so that
+        // as the install script clones additional repos, they can be pinned to
+        // the commits recorded in checkpoints.json. Then send the user to the
+        // normal workspace page so installation happens through the usual UI.
+        if (this.kernel.git && this.kernel.git.activeSnapshot) {
+          const found = await this.kernel.git.findSnapshotForFolder(workspace, snapshotId)
+          const remoteKey = found && found.remoteKey ? found.remoteKey : null
+          this.kernel.git.activeSnapshot[workspace] = { id: snapshotId, remoteKey }
+        }
+        res.redirect(`/p/${workspace}`)
+      } else {
+        res.redirect("/backups")
+      }
+    }))
+    this.app.post("/checkpoints/restore/:workspace/:snapshotId", ex(async (req, res) => {
+      const workspace = typeof req.params.workspace === 'string' ? req.params.workspace : ''
+      const snapshotId = req.params.snapshotId
+      const ok = await this.kernel.git.downloadMainFromSnapshot(workspace, snapshotId)
+      let meta = null
+      if (ok) {
+        try {
+          meta = await this.kernel.api.meta(workspace)
+        } catch (_) {
+          meta = null
+        }
+      }
+      res.json({ ok: !!ok, meta })
+    }))
     this.app.get("/agents", ex(async (req, res) => {
       let pluginMenu = []
       try {
@@ -7417,10 +8132,31 @@ class Server {
     }))
     this.app.get("/info/gitstatus/:name", ex(async (req, res) => {
       try {
-        const workspaceRoot = this.kernel.path("api", req.params.name)
+        const workspaceName = req.params.name
+        const workspaceRoot = this.kernel.path("api", workspaceName)
+        const forceRefresh = req.query && (req.query.force === '1' || req.query.force === 'true')
+
+        if (forceRefresh && this.workspaceStatus && typeof this.workspaceStatus.markDirty === 'function') {
+          this.workspaceStatus.markDirty(workspaceName)
+        }
+
+        if (forceRefresh) {
+          const data = await this.computeWorkspaceGitStatus(workspaceName)
+          if (this.workspaceStatus && this.workspaceStatus.cache instanceof Map) {
+            this.workspaceStatus.cache.set(workspaceName, {
+              dirty: false,
+              inflight: null,
+              data,
+              updatedAt: Date.now()
+            })
+          }
+          res.json(data)
+          return
+        }
+
         const data = await this.workspaceStatus.getStatus(
-          req.params.name,
-          () => this.computeWorkspaceGitStatus(req.params.name),
+          workspaceName,
+          () => this.computeWorkspaceGitStatus(workspaceName),
           workspaceRoot
         )
         res.json(data)
@@ -7824,7 +8560,11 @@ class Server {
         req.launcher_root = launcher.launcher_root
         config = await this.processMenu(name, config)
       } catch(e) {
-        config.menu = []
+        if (config) {
+          config.menu = []
+        } else {
+          config = { menu: [] }
+        }
         err = e.stack
       }
       await this.renderMenu(req, uri, name, config, [])
@@ -8340,16 +9080,20 @@ class Server {
       })
     }))
     this.app.get("/p/:name/dev", ex(async (req, res) => {
-      await this.chrome(req, res, "browse")
+      const { hasSnapshots, pendingSnapshotId } = await this.getSnapshotStatus(req.params.name)
+      await this.chrome(req, res, "browse", { hasSnapshots, pendingSnapshotId })
     }))
     this.app.get("/p/:name/files", ex(async (req, res) => {
-      await this.chrome(req, res, "files")
+      const { hasSnapshots, pendingSnapshotId } = await this.getSnapshotStatus(req.params.name)
+      await this.chrome(req, res, "files", { hasSnapshots, pendingSnapshotId })
     }))
     this.app.get("/p/:name/browse", ex(async (req, res) => {
-      await this.chrome(req, res, "browse")
+      const { hasSnapshots, pendingSnapshotId } = await this.getSnapshotStatus(req.params.name)
+      await this.chrome(req, res, "browse", { hasSnapshots, pendingSnapshotId })
     }))
     this.app.get("/p/:name", ex(async (req, res) => {
-      await this.chrome(req, res, "run")
+      const { hasSnapshots, pendingSnapshotId } = await this.getSnapshotStatus(req.params.name)
+      await this.chrome(req, res, "run", { hasSnapshots, pendingSnapshotId })
     }))
     this.app.post("/pinokio/delete", ex(async (req, res) => {
       try {
@@ -8487,6 +9231,55 @@ class Server {
       let queryStr = new URLSearchParams(req.query).toString()
       res.redirect("/home?mode=download&" + queryStr)
     }))
+    this.app.post("/pinokio/install/exists", ex(async (req, res) => {
+      if (!this.kernel || !this.kernel.homedir) {
+        return res.status(500).json({ error: "Pinokio home directory not set" })
+      }
+
+      const body = req.body && typeof req.body === "object" ? req.body : {}
+      const folderName = typeof body.folderName === "string" ? body.folderName.trim() : ""
+
+      if (!folderName) {
+        return res.status(400).json({ error: "folderName is required" })
+      }
+
+      if (folderName === "." || folderName === ".." || /[\\/]/.test(folderName) || folderName.includes("\0")) {
+        return res.status(400).json({ error: "Invalid folderName" })
+      }
+
+      let sanitizedPath = null
+      if (typeof body.relativePath === "string") {
+        let trimmed = body.relativePath.trim()
+        if (trimmed) {
+          trimmed = trimmed.replace(/^~[\\/]?/, "").replace(/^[\\/]+/, "")
+          if (trimmed) {
+            const segments = trimmed.split(/[\\/]+/).filter(Boolean)
+            if (segments.length > 0 && !segments.some((segment) => segment === "." || segment === "..")) {
+              sanitizedPath = segments.join("/")
+            }
+          }
+        }
+      }
+
+      if (!sanitizedPath) {
+        sanitizedPath = "api"
+      }
+
+      const home = path.resolve(this.kernel.homedir)
+      const target = path.resolve(home, sanitizedPath, folderName)
+      const homeWithSep = home.endsWith(path.sep) ? home : home + path.sep
+
+      if (!target.startsWith(homeWithSep)) {
+        return res.status(400).json({ error: "Invalid install destination" })
+      }
+
+      const exists = await fs.promises
+        .access(target, fs.constants.F_OK)
+        .then(() => true)
+        .catch(() => false)
+
+      res.json({ exists })
+    }))
     this.app.post("/pinokio/install", ex((req, res) => {
       req.session.requirements = req.body.requirements
       req.session.callback = req.body.callback
@@ -8594,6 +9387,32 @@ class Server {
       }
 
     }))
+    this.app.post("/create-upload", this.upload.any(), ex(async (req, res) => {
+      try {
+        const files = Array.isArray(req.files) ? req.files : [];
+        if (!files.length) {
+          return res.status(400).json({ error: "No files provided" });
+        }
+        const token = crypto.randomBytes(16).toString("hex");
+        const baseDir = this.kernel.path("tmp", "create", token);
+        await fs.promises.mkdir(baseDir, { recursive: true });
+        const stored = [];
+        for (const file of files) {
+          if (!file || !file.buffer) continue;
+          const filename = path.basename(file.originalname || "file");
+          const target = path.resolve(baseDir, filename);
+          await fs.promises.writeFile(target, file.buffer);
+          stored.push({ name: filename, size: file.size });
+        }
+        if (!stored.length) {
+          return res.status(400).json({ error: "No valid files provided" });
+        }
+        res.json({ uploadToken: token, files: stored });
+      } catch (error) {
+        console.log("create-upload error", error);
+        res.status(500).json({ error: error.message || "Upload failed" });
+      }
+    }))
     /*
       SYNTAX
       fs.uri(<bin|api>, path)