pinokiod 7.3.0 → 7.3.3

package/server/index.js

@@ -30,6 +30,8 @@ const registerFileRoutes = require('./routes/files')
 const registerAppRoutes = require('./routes/apps')
 const Git = require("../kernel/git")
 const TerminalApi = require('../kernel/api/terminal')
+const PluginSources = require("../kernel/plugin_sources")
+const ManagedSkills = require("../kernel/managed_skills")
 
 const git = require('isomorphic-git')
 const http = require('isomorphic-git/http/node')
@@ -82,8 +84,10 @@ const { createContentValidationService } = require("./lib/content_validation")
 const { buildSecureRouterDebugSnapshot, createSecureRouterDebugStore } = require("./lib/secure_router_debug")
 const AppRegistryService = require("./lib/app_registry")
 const AppLogService = require("./lib/app_logs")
+const AppLogReportService = require("./lib/app_log_report")
 const AppSearchService = require("./lib/app_search")
 const AppPreferencesService = require("./lib/app_preferences")
+const ResourceUsageService = require("../kernel/resource_usage")
 
 function normalize(str) {
   if (!str) return '';
@@ -214,7 +218,9 @@ class Server {
     this.appRegistry = new AppRegistryService({ kernel: this.kernel })
     this.appPreferences = new AppPreferencesService({ kernel: this.kernel })
     this.kernel.appPreferences = this.appPreferences
+    this.resourceUsage = new ResourceUsageService({ kernel: this.kernel })
     this.appLogs = new AppLogService({ registry: this.appRegistry })
+    this.appLogReports = new AppLogReportService({ registry: this.appRegistry, kernel: this.kernel })
     this.appSearch = new AppSearchService({
       kernel: this.kernel,
       registry: this.appRegistry,
@@ -491,14 +497,12 @@ class Server {
                 assignProjectSlug(obj)
                 running_dynamic.push(obj)
               }
-            } else if (href.startsWith("/run")) {
-              let uri_path = new URL("http://localhost" + href).pathname
-              let _filepath = uri_path.split("/").filter(x=>x).slice(1)
-              let filepath = this.kernel.path(..._filepath)
+            } else if (PluginSources.isRunPath(href)) {
+              let filepath = PluginSources.resolveRunPath(this.kernel, href)
               let id = `${filepath}?cwd=${cwd}`
               obj.script_id = id
               //if (this.kernel.api.running[filepath]) {
-              if (obj.src.startsWith("/run" + selected_query.plugin)) {
+              if (PluginSources.pluginSelectionMatches(obj.src, selected_query && selected_query.plugin)) {
                 obj.running = true
                 obj.display = "indent"
                 obj.default = true
@@ -920,15 +924,8 @@ class Server {
 
     const config = await this.kernel.git.config(dir)
 
-    let hosts = ""
-    const hostsFile = this.kernel.path("config/gh/hosts.yml")
-    if (await this.exists(hostsFile)) {
-      hosts = await fs.promises.readFile(hostsFile, "utf8")
-      if (hosts.startsWith("{}")) {
-        hosts = ""
-      }
-    }
-    const connected = hosts.length > 0
+    const githubConnection = await this.get_github_connection()
+    const connected = Boolean(githubConnection.connected)
 
     let remote = null
     if (config && config["remote \"origin\""]) {
@@ -990,6 +987,10 @@ class Server {
     }
   }
   async get_github_hosts() {
+    const connection = await this.get_github_connection()
+    return connection.display
+  }
+  async get_legacy_github_hosts() {
     let hosts = ""
     let hosts_file = this.kernel.path("config/gh/hosts.yml")
     let e = await this.exists(hosts_file)
@@ -1001,6 +1002,135 @@ class Server {
     }
     return hosts
   }
+  github_command_env(interactive = false) {
+    const env = this.kernel && this.kernel.envs
+      ? { ...this.kernel.envs }
+      : (this.kernel && this.kernel.bin && typeof this.kernel.bin.envs === 'function'
+          ? this.kernel.bin.envs(process.env)
+          : { ...process.env })
+
+    if (interactive) {
+      delete env.GCM_INTERACTIVE
+      delete env.GIT_TERMINAL_PROMPT
+      delete env.GIT_ASKPASS
+      delete env.SSH_ASKPASS
+    } else {
+      Object.assign(env, NON_INTERACTIVE_GIT_ENV)
+    }
+
+    return env
+  }
+  async github_gcm(args, options = {}) {
+    return new Promise((resolve, reject) => {
+      execFile(
+        'git',
+        ['credential-manager', 'github', ...args],
+        {
+          cwd: this.kernel.homedir,
+          env: this.github_command_env(Boolean(options.interactive)),
+          timeout: Number.isFinite(options.timeout) ? options.timeout : 15000,
+          maxBuffer: 1024 * 1024,
+        },
+        (error, stdout, stderr) => {
+          if (error) {
+            error.stderr = stderr
+            reject(error)
+            return
+          }
+          resolve(stdout || "")
+        }
+      )
+    })
+  }
+  async get_github_connection() {
+    if (this._githubConnectionPromise) {
+      return this._githubConnectionPromise
+    }
+
+    this._githubConnectionPromise = (async () => {
+      const legacyHosts = await this.get_legacy_github_hosts()
+      let accounts = []
+      let gcmError = null
+
+      try {
+        const stdout = await this.github_gcm(['list'], { timeout: 10000 })
+        accounts = stdout
+          .split(/\r?\n/)
+          .map((line) => line.trim())
+          .filter(Boolean)
+      } catch (error) {
+        gcmError = error && (error.stderr || error.message) ? String(error.stderr || error.message).trim() : String(error)
+      }
+
+      const display = accounts.length > 0
+        ? accounts.map((account) => `github.com: ${account}`).join("\n")
+        : ""
+
+      return {
+        accounts,
+        legacyHosts,
+        display,
+        connected: accounts.length > 0,
+        provider: accounts.length > 0 ? "gcm" : null,
+        gcmError,
+      }
+    })()
+
+    try {
+      return await this._githubConnectionPromise
+    } finally {
+      this._githubConnectionPromise = null
+    }
+  }
+  github_login_params() {
+    const doneMarker = "PINOKIO_GITHUB_LOGIN_DONE"
+    const delimiter = this.kernel.platform === "win32" ? " && " : " ; "
+    const verifyCommand = this.kernel.platform === "win32"
+      ? "cmd /C \"set GIT_TERMINAL_PROMPT=0&& set GCM_INTERACTIVE=never&& (echo protocol=https& echo host=github.com& echo.) | git credential fill >NUL\""
+      : "printf 'protocol=https\\nhost=github.com\\n\\n' | GIT_TERMINAL_PROMPT=0 GCM_INTERACTIVE=never git credential fill >/dev/null"
+    const doneCommand = this.kernel.platform === "win32"
+      ? "echo P^INOKIO_GITHUB_LOGIN_DONE"
+      : "(GCM_DONE=INOKIO_GITHUB_LOGIN_DONE; printf 'P%s\\n' \"$GCM_DONE\")"
+    const loginCommand = [
+      "git credential-manager github login --web --force",
+      verifyCommand,
+      doneCommand
+    ].join(" && ")
+
+    return {
+      doneMarker,
+      message: [
+        "git config --global --replace-all credential.helper manager",
+        "git config --global --replace-all credential.gitHubAuthModes oauth",
+        "git config --global --replace-all credential.namespace pinokio",
+        "git config --global --replace-all credential.https://github.com.helper manager",
+        "git config --global --replace-all credential.https://github.com.provider github",
+        loginCommand
+      ].join(delimiter)
+    }
+  }
+  github_logout_command(connection) {
+    const accounts = connection && Array.isArray(connection.accounts) ? connection.accounts : []
+    const safeAccounts = accounts.filter((account) => /^[A-Za-z0-9._-]+$/.test(account))
+    if (safeAccounts.length === 0) {
+      return null
+    }
+    const delimiter = this.kernel.platform === "win32" ? " && " : " ; "
+    return safeAccounts.map((account) => `git credential-manager github logout ${account}`).join(delimiter)
+  }
+  async github_logout_params(connection) {
+    const hadLegacyAuth = Boolean(connection && connection.legacyHosts && connection.legacyHosts.length > 0)
+    if (hadLegacyAuth) {
+      await this.clear_legacy_github_auth()
+    }
+    return {
+      hadLegacyAuth,
+      message: this.github_logout_command(connection)
+    }
+  }
+  async clear_legacy_github_auth() {
+    await fs.promises.rm(this.kernel.path("config/gh/hosts.yml"), { force: true }).catch(() => {})
+  }
   async current_urls(current_path) {
     return {}
 //    let router_running = await this.check_router_up()
@@ -1037,6 +1167,296 @@ class Server {
       list: this.getPeers(),
     }
   }
+  normalizeAutolaunchAppId(value) {
+    if (typeof value !== "string") {
+      return ""
+    }
+    const id = value.trim()
+    if (!id || id === "." || id === ".." || id.includes("\0") || /[\\/]/.test(id)) {
+      return ""
+    }
+    return id
+  }
+  normalizeAutolaunchScriptPath(value) {
+    if (typeof value !== "string") {
+      return ""
+    }
+    let script = value.trim().replace(/\\/g, "/")
+    if (!script || script.includes("\0")) {
+      return ""
+    }
+    script = script.split("#")[0].split("?")[0].trim()
+    if (!script || /^[a-zA-Z][a-zA-Z\d+\-.]*:/.test(script) || script.startsWith("//")) {
+      return ""
+    }
+    if (script.startsWith("/")) {
+      return ""
+    }
+    const normalized = path.posix.normalize(script).replace(/^\.\/+/, "")
+    if (!normalized || normalized === "." || normalized === ".." || normalized.startsWith("../") || path.posix.isAbsolute(normalized)) {
+      return ""
+    }
+    return normalized
+  }
+  isAutolaunchScriptFilename(filename) {
+    const ext = path.extname(filename || "").toLowerCase()
+    if (![".js", ".json", ".mjs", ".cjs"].includes(ext)) {
+      return false
+    }
+    const base = path.basename(filename || "").toLowerCase()
+    return !["package.json", "pinokio.js", "pinokio.json", "pinokio_meta.json"].includes(base)
+  }
+  stripAutolaunchLabel(value) {
+    if (typeof value !== "string") {
+      return ""
+    }
+    return value
+      .replace(/<[^>]*>/g, " ")
+      .replace(/\s+/g, " ")
+      .trim()
+  }
+  async getAutolaunchAppById(appId) {
+    const id = this.normalizeAutolaunchAppId(appId)
+    if (!id) {
+      return null
+    }
+    const apps = await this.kernel.api.listApps()
+    return apps.find((app) => app && app.id === id) || null
+  }
+  async getAutolaunchEnvInfo(app) {
+    const appRoot = path.resolve(this.kernel.api.userdir, app.id)
+    const gotRoot = await Environment.get_root({ path: appRoot }, this.kernel)
+    const envRoot = gotRoot && gotRoot.root ? gotRoot.root : appRoot
+    const envPath = path.resolve(envRoot, "ENVIRONMENT")
+    const env = await Util.parse_env(envPath)
+    const value = typeof env.PINOKIO_SCRIPT_AUTOLAUNCH === "string"
+      ? env.PINOKIO_SCRIPT_AUTOLAUNCH.trim()
+      : ""
+    const exists = await this.exists(envPath)
+    return {
+      appRoot,
+      envRoot,
+      envPath,
+      envRelpath: gotRoot && gotRoot.relpath ? gotRoot.relpath : "",
+      exists,
+      value,
+      enabled: value.length > 0
+    }
+  }
+  async buildAutolaunchAppState(app) {
+    const envInfo = await this.getAutolaunchEnvInfo(app)
+    return {
+      id: app.id,
+      name: app.name,
+      title: app.title || app.name || app.id,
+      description: app.description || "",
+      icon: app.icon || "/pinokio-black.png",
+      workspace_path: app.workspace_path,
+      launcher_path: app.launcher_path,
+      launcher_root: app.launcher_root || "",
+      env_path: envInfo.envPath,
+      autolaunch: envInfo.value,
+      autolaunch_enabled: envInfo.enabled
+    }
+  }
+  async buildAutolaunchAppsState() {
+    const apps = await this.kernel.api.listApps()
+    const states = []
+    for (const app of apps) {
+      states.push(await this.buildAutolaunchAppState(app))
+    }
+    return states
+  }
+  async resolveAutolaunchScript(appRoot, script) {
+    const normalized = this.normalizeAutolaunchScriptPath(script)
+    if (!normalized || !this.isAutolaunchScriptFilename(normalized)) {
+      return null
+    }
+    const scriptPath = path.resolve(appRoot, normalized)
+    if (!this.is_subpath(appRoot, scriptPath)) {
+      return null
+    }
+    let stat
+    try {
+      stat = await fs.promises.stat(scriptPath)
+    } catch (_) {
+      return null
+    }
+    if (!stat || !stat.isFile()) {
+      return null
+    }
+    return {
+      script: normalized,
+      path: scriptPath
+    }
+  }
+  flattenAutolaunchMenu(menu, trail = []) {
+    const items = []
+    if (!Array.isArray(menu)) {
+      return items
+    }
+    for (const menuitem of menu) {
+      if (!menuitem || typeof menuitem !== "object") {
+        continue
+      }
+      const label = this.stripAutolaunchLabel(menuitem.text || menuitem.name || menuitem.html || "")
+      const nextTrail = label ? trail.concat(label) : trail
+      if (Array.isArray(menuitem.menu)) {
+        items.push(...this.flattenAutolaunchMenu(menuitem.menu, nextTrail))
+      } else {
+        items.push({ item: menuitem, group: trail.join(" / ") })
+      }
+    }
+    return items
+  }
+  async addAutolaunchCandidate(candidates, seen, candidate, appRoot) {
+    const resolved = await this.resolveAutolaunchScript(appRoot, candidate.script)
+    if (!resolved || seen.has(resolved.script)) {
+      return null
+    }
+    seen.add(resolved.script)
+    const label = this.stripAutolaunchLabel(candidate.label || "") || resolved.script
+    const menuDefault = !!candidate.menu_default
+    const item = {
+      script: resolved.script,
+      label,
+      group: candidate.group || "",
+      icon: candidate.icon || "",
+      source: candidate.source || "local",
+      menu_default: menuDefault,
+      has_params: !!candidate.has_params
+    }
+    candidates.push(item)
+    return item
+  }
+  async collectAutolaunchScriptFiles(root, appRoot) {
+    const results = []
+    const ignoredDirs = new Set([
+      ".git",
+      ".venv",
+      "__pycache__",
+      "app",
+      "cache",
+      "data",
+      "env",
+      "logs",
+      "models",
+      "node_modules",
+      "output",
+      "outputs",
+      "venv"
+    ])
+    const maxResults = 500
+    const walk = async (dir, depth) => {
+      if (depth > 4 || results.length >= maxResults) {
+        return
+      }
+      let entries
+      try {
+        entries = await fs.promises.readdir(dir, { withFileTypes: true })
+      } catch (_) {
+        return
+      }
+      for (const entry of entries) {
+        if (!entry || !entry.name || entry.name.includes("\0")) {
+          continue
+        }
+        const fullPath = path.resolve(dir, entry.name)
+        if (entry.isDirectory()) {
+          if (!ignoredDirs.has(entry.name)) {
+            await walk(fullPath, depth + 1)
+          }
+          continue
+        }
+        if (!entry.isFile() || !this.isAutolaunchScriptFilename(entry.name)) {
+          continue
+        }
+        if (!this.is_subpath(appRoot, fullPath)) {
+          continue
+        }
+        const rel = path.relative(appRoot, fullPath).split(path.sep).join("/")
+        results.push(rel)
+      }
+    }
+    await walk(root, 0)
+    results.sort((a, b) => a.localeCompare(b))
+    return results
+  }
+  async buildAutolaunchCandidates(app) {
+    const envInfo = await this.getAutolaunchEnvInfo(app)
+    const appRoot = envInfo.appRoot
+    const launcher = await this.kernel.api.launcher(app.id)
+    const launcherRoot = launcher && launcher.launcher_root
+      ? path.resolve(appRoot, launcher.launcher_root)
+      : appRoot
+    const menuCandidates = []
+    const otherCandidates = []
+    const seen = new Set()
+
+    try {
+      let config = await this.kernel.api.meta(app.id)
+      config = await this.processMenu(app.id, safeStructuredClone(config || {}))
+      const flat = this.flattenAutolaunchMenu(config && config.menu ? config.menu : [])
+      for (const entry of flat) {
+        const menuitem = entry.item
+        if (!menuitem || typeof menuitem.href !== "string") {
+          continue
+        }
+        let href = menuitem.href.trim()
+        const apiPrefix = `/api/${app.id}/`
+        if (href.startsWith(apiPrefix)) {
+          href = href.slice(apiPrefix.length)
+        } else if (href.startsWith("/")) {
+          continue
+        }
+        const localScript = this.normalizeAutolaunchScriptPath(href)
+        if (!localScript) {
+          continue
+        }
+        const scriptPath = path.resolve(launcherRoot, localScript)
+        if (!this.is_subpath(appRoot, scriptPath)) {
+          continue
+        }
+        const script = path.relative(appRoot, scriptPath).split(path.sep).join("/")
+        await this.addAutolaunchCandidate(menuCandidates, seen, {
+          script,
+          label: menuitem.text || menuitem.name || script,
+          group: entry.group,
+          icon: typeof menuitem.icon === "string" ? menuitem.icon : "",
+          source: "menu",
+          menu_default: !!menuitem.default,
+          has_params: !!(menuitem.params && typeof menuitem.params === "object")
+        }, appRoot)
+      }
+    } catch (error) {
+      console.warn("[autolaunch] failed to resolve menu candidates", app.id, error && error.message ? error.message : error)
+    }
+
+    if (envInfo.value) {
+      await this.addAutolaunchCandidate(menuCandidates, seen, {
+        script: envInfo.value,
+        label: envInfo.value,
+        source: "current"
+      }, appRoot)
+    }
+
+    const localScripts = await this.collectAutolaunchScriptFiles(launcherRoot, appRoot)
+    for (const script of localScripts) {
+      await this.addAutolaunchCandidate(otherCandidates, seen, {
+        script,
+        label: script,
+        source: "local"
+      }, appRoot)
+    }
+
+    return {
+      app: await this.buildAutolaunchAppState(app),
+      launcher_root: path.relative(appRoot, launcherRoot).split(path.sep).join("/"),
+      menu: menuCandidates,
+      other: otherCandidates,
+      current: envInfo.value
+    }
+  }
   async renderInvalidContentPage(req, res, invalid, options = {}) {
     const type = invalid && typeof invalid.type === "string" ? invalid.type : "app"
     const sidebarSelected = options.sidebarSelected || (type === "plugin" ? "plugins" : type === "task" ? "tasks" : "home")
@@ -1239,6 +1659,9 @@ class Server {
     let dev_tab = "/p/" + name + "/dev"
     let review_tab = "/p/" + name + "/review"
     let files_tab = "/p/" + name + "/files"
+    const dev_initial_tab = type === "browse" && req.query && req.query.pinokio_dev_tab === "files"
+      ? "files"
+      : "plugins"
 
     const registryEnabled = await this.isRegistryEnabled().catch(() => false)
     let community_url = ""
@@ -1272,13 +1695,16 @@ class Server {
     }
 
     let dynamic_url = "/pinokio/dynamic/" + name;
-    if (Object.values(req.query).length > 0) {
+    const dynamicQueryEntries = Object.entries(req.query || {}).filter(([key]) => {
+      return key !== "pinokio_dev_tab"
+    })
+    if (dynamicQueryEntries.length > 0) {
       let index = 0
-      for(let key in req.query) {
+      for (let [key, value] of dynamicQueryEntries) {
         if (index === 0) {
-          dynamic_url = dynamic_url + `?${key}=${encodeURIComponent(req.query[key])}`
+          dynamic_url = dynamic_url + `?${key}=${encodeURIComponent(value)}`
         } else {
-          dynamic_url = dynamic_url + `&${key}=${encodeURIComponent(req.query[key])}`
+          dynamic_url = dynamic_url + `&${key}=${encodeURIComponent(value)}`
         }
         index++;
       }
@@ -1286,6 +1712,22 @@ class Server {
     const protectionPreference = this.appPreferences && typeof this.appPreferences.getPreference === "function"
       ? await this.appPreferences.getPreference(name)
       : null
+    let autolaunchAppState = null
+    try {
+      const appRoot = this.kernel.path("api", name)
+      autolaunchAppState = await this.buildAutolaunchAppState({
+        id: name,
+        name,
+        title: config && config.title ? config.title : name,
+        description: config && config.description ? config.description : "",
+        icon: config && config.icon ? config.icon : "/pinokio-black.png",
+        workspace_path: appRoot,
+        launcher_path: req.launcher_root ? path.resolve(appRoot, req.launcher_root) : appRoot,
+        launcher_root: req.launcher_root || ""
+      })
+    } catch (error) {
+      console.warn("[autolaunch] failed to build app page state", name, error && error.message ? error.message : error)
+    }
 
     const result = {
       dev_link,
@@ -1317,8 +1759,10 @@ class Server {
 //      feed,
       tabs: savedTabs,
       editor_tab: editor_tab,
+      dev_initial_tab,
       config,
       protection_enabled: protectionPreference ? protectionPreference.protection_enabled !== false : false,
+      autolaunch_app: autolaunchAppState,
 //        sidebar_url: "/pinokio/sidebar/" + name,
       home: req.originalUrl,
       run_tab,
@@ -2091,15 +2535,8 @@ class Server {
 
     const config = await this.kernel.git.config(dir)
 
-    let hosts = ""
-    const hostsFile = this.kernel.path("config/gh/hosts.yml")
-    if (await this.exists(hostsFile)) {
-      hosts = await fs.promises.readFile(hostsFile, "utf8")
-      if (hosts.startsWith("{}")) {
-        hosts = ""
-      }
-    }
-    const connected = hosts.length > 0
+    const githubConnection = await this.get_github_connection()
+    const connected = Boolean(githubConnection.connected)
 
     let remote = null
     if (config && config["remote \"origin\""]) {
@@ -2393,8 +2830,10 @@ class Server {
       filepath = full_filepath
     }
 
-    if ((req.action || req.originalUrl.startsWith("/run/")) && this.contentValidation) {
-      const validation = await this.contentValidation.validateRunPath(pathComponents)
+    if ((req.action || PluginSources.isRunPath(req.originalUrl)) && this.contentValidation) {
+      const validation = await this.contentValidation.validateRunPath(pathComponents, {
+        system: req.pinokioSystem === true,
+      })
       if (validation && !validation.valid) {
         await this.renderInvalidContentPage(req, res, validation, {
           sidebarSelected: validation.type === "plugin" ? "plugins" : validation.type === "task" ? "tasks" : "home",
@@ -2753,10 +3192,12 @@ class Server {
           } else {
             resolved = runner(this.kernel, this.kernel.info)
           }
-          runnable = resolved && Array.isArray(resolved[actionKey]) && resolved[actionKey].length > 0
+          const action = resolved ? resolved[actionKey] : null
+          runnable = typeof action === "function" || (Array.isArray(action) && action.length > 0)
         } else {
-          runnable = runner && Array.isArray(runner[actionKey]) && runner[actionKey].length > 0
           resolved = runner
+          const action = resolved ? resolved[actionKey] : null
+          runnable = typeof action === "function" || (Array.isArray(action) && action.length > 0)
         }
 
         let template = "terminal"
@@ -2865,11 +3306,19 @@ class Server {
           const protectionPreference = protectionAppId && this.appPreferences && typeof this.appPreferences.getPreference === "function"
             ? await this.appPreferences.getPreference(protectionAppId)
             : null
+          const activeProcessWait = this.kernel.activeProcessWaits && this.kernel.activeProcessWaits[filepath]
+            ? this.kernel.activeProcessWaits[filepath]
+            : null
           const result = {
             portal: this.portal,
             projectName: (pathComponents.length > 0 ? pathComponents[0] : ''),
             protection_app_id: protectionAppId,
             protection_enabled: protectionPreference ? protectionPreference.protection_enabled !== false : false,
+            active_process_wait: activeProcessWait ? {
+              title: activeProcessWait.title,
+              description: activeProcessWait.description,
+              message: activeProcessWait.message
+            } : null,
             kill_message,
             callback,
             callback_target,
@@ -2884,6 +3333,7 @@ class Server {
             //run: true,    // run mode by default
             run: (req.query && req.query.mode === "source" ? false : true),
             stop: (req.query && req.query.stop ? true : false),
+            readonly: req.pinokioSystem === true,
             pinokioPath,
             action: actionKey,
             runnable,
@@ -3100,6 +3550,7 @@ class Server {
       if (pathComponents.length === 0) {
         const normalizedApiRoot = path.normalize(this.kernel.path("api"))
         const normalizedPluginRoot = path.normalize(this.kernel.path("plugin"))
+        const normalizedSystemPluginRoot = path.normalize(PluginSources.systemPluginRoot(this.kernel))
         const isPathWithinRoot = (candidatePath, rootPath) => {
           if (typeof candidatePath !== "string" || typeof rootPath !== "string") {
             return false
@@ -3125,6 +3576,9 @@ class Server {
           if (isPathWithinRoot(normalizedCandidate, normalizedPluginRoot)) {
             return true
           }
+          if (isPathWithinRoot(normalizedCandidate, normalizedSystemPluginRoot)) {
+            return true
+          }
           const relativeToApiRoot = path.relative(normalizedApiRoot, normalizedCandidate)
           if (!relativeToApiRoot || relativeToApiRoot.startsWith("..") || path.isAbsolute(relativeToApiRoot)) {
             return false
@@ -3138,6 +3592,8 @@ class Server {
           let item = items[i]
           let launcher = await this.kernel.api.launcher(item.name)
           let config = launcher.script
+          req.launcher_root = launcher.launcher_root
+          req.pinokioLauncher = launcher
           await this.kernel.dns({
             name: item.name,
             config
@@ -3145,6 +3601,13 @@ class Server {
 
 
           if (config) {
+            try {
+              config = await this.processMenu(item.name, config)
+              await this.renderMenu(req, this.kernel.path("api"), item.name, config, [])
+              items[i].menu = Array.isArray(config.menu) ? config.menu : []
+            } catch (e) {
+              items[i].menu = []
+            }
 
             if (config.shortcuts) {
               if (typeof config.shortcuts === "function") {
@@ -3786,6 +4249,33 @@ class Server {
       menuitem.href = "/shell/" + shell_id + "?" + params.toString()
       let decoded_shell_id = decodeURIComponent(shell_id)
       const shellPrefixId = "shell/" + decoded_shell_id
+      const appendShellIdentityParams = (href, activeShellId) => {
+        if (!href || typeof href !== "string" || !activeShellId || typeof activeShellId !== "string") {
+          return href
+        }
+        const shellQueryIndex = activeShellId.indexOf("?")
+        if (shellQueryIndex < 0) {
+          return href
+        }
+        let identityParams
+        try {
+          identityParams = new URLSearchParams(activeShellId.slice(shellQueryIndex + 1).replace(/&amp;/g, "&"))
+        } catch (error) {
+          return href
+        }
+        const hrefQueryIndex = href.indexOf("?")
+        const pathPart = hrefQueryIndex >= 0 ? href.slice(0, hrefQueryIndex) : href
+        const queryPart = hrefQueryIndex >= 0 ? href.slice(hrefQueryIndex + 1) : ""
+        const nextParams = new URLSearchParams(queryPart)
+        ;["session", "terminal_id"].forEach((key) => {
+          const value = identityParams.get(key)
+          if (value && !nextParams.has(key)) {
+            nextParams.set(key, value)
+          }
+        })
+        const qs = nextParams.toString()
+        return qs ? `${pathPart}?${qs}` : pathPart
+      }
       let shell = this.kernel.shell.get(shellPrefixId)
       if (!shell && this.kernel.shell && Array.isArray(this.kernel.shell.shells)) {
         shell = this.kernel.shell.shells.find((entry) => {
@@ -3797,6 +4287,8 @@ class Server {
       }
       menuitem.shell_id = shellPrefixId
       if (shell) {
+        menuitem.shell_id = shell.id || shellPrefixId
+        menuitem.href = appendShellIdentityParams(menuitem.href, shell.id)
         menuitem.running = true
       }
     }
@@ -3938,8 +4430,7 @@ class Server {
           if (menuitem.href.startsWith("http")) {
             menuitem.src = menuitem.href
           } else if (menuitem.href.startsWith("/")) {
-            let run_path = "/run"
-            if (menuitem.href.startsWith(run_path)) {
+            if (PluginSources.isRunPath(menuitem.href)) {
               menuitem.src = menuitem.href
 //              u = new URL("http://localhost" + menuitem.href.slice(run_path.length))
 //              cwd = u.searchParams.get("cwd")
@@ -3959,7 +4450,14 @@ class Server {
           }
 
           // check running
-          let fullpath = this.kernel.path(menuitem.src.slice(1))
+          let srcPathname = menuitem.src
+          try {
+            srcPathname = new URL("http://localhost" + menuitem.src).pathname
+          } catch (_) {
+          }
+          let fullpath = PluginSources.isRunPath(srcPathname)
+            ? PluginSources.resolveRunPath(this.kernel, srcPathname)
+            : this.kernel.path(srcPathname.slice(1))
           let relpath = path.relative(this.kernel.homedir, fullpath)
           if (relpath.startsWith("api")) {
             // api script
@@ -5279,15 +5777,7 @@ class Server {
     return normalized
   }
   isValidBundledPluginConfig(pluginConfig) {
-    if (!pluginConfig || !Array.isArray(pluginConfig.run)) {
-      return false
-    }
-    for (const key of Object.keys(pluginConfig)) {
-      if (typeof pluginConfig[key] === "function") {
-        return false
-      }
-    }
-    return true
+    return PluginSources.isValidPluginConfig(pluginConfig)
   }
   isPathInsideRootForBundledPlugin(candidatePath, rootPath) {
     const relative = path.relative(rootPath, candidatePath)
@@ -5673,7 +6163,6 @@ class Server {
       "prototype/PTERM.md",
     ]
     const managedRefreshTargets = [
-      "plugin/code",
       "prototype/system",
       "network/system",
       "prototype/PINOKIO.md",
@@ -5695,6 +6184,15 @@ class Server {
 
         needsManagedRefresh = true
         console.log("[TRY] Updating to the new version")
+        let envPath = path.resolve(home, "ENVIRONMENT")
+        let envExists = await this.kernel.exists(envPath)
+        if (!envExists) {
+          let str = await Environment.ENV("system", home, this.kernel)
+          await fs.promises.writeFile(envPath, str)
+        }
+        await Environment.ensurePinokioCacheDirs(this.kernel, {
+          throwOnFailure: true
+        })
         this.kernel.store.set("version", this.version.pinokiod)
         console.log("[DONE] Updating to the new version")
         console.log("not up to date. update py.")
@@ -5707,9 +6205,6 @@ class Server {
         let p2 = path.resolve(home, "prototype/system")
         await fse.remove(p2)
 
-        let p3 = path.resolve(home, "plugin/code")
-        await fse.remove(p3)
-
         let p4 = path.resolve(home, "network/system")
         await fse.remove(p4)
 
@@ -5778,10 +6273,6 @@ class Server {
             await this.kernel.proto.init()
           }
           if (needsManagedRefresh) {
-            const pluginReady = await this.kernel.exists("plugin/code")
-            if (!pluginReady && this.kernel.plugin && typeof this.kernel.plugin.init === "function") {
-              await this.kernel.plugin.init()
-            }
             const networkReady = await this.kernel.exists("network/system")
             if (!networkReady && this.kernel.router && typeof this.kernel.router.init === "function") {
               await this.kernel.router.init()
@@ -5962,6 +6453,10 @@ class Server {
     })
     this.app.use(express.static(path.resolve(__dirname, 'public')));
     this.app.use("/web", express.static(path.resolve(__dirname, "..", "..", "web")))
+    this.app.use(PluginSources.SYSTEM_ASSET_PREFIX, express.static(PluginSources.systemRoot(this.kernel), {
+      index: false,
+      fallthrough: true,
+    }))
     this.app.set('view engine', 'ejs');
     this.app.use((req, res, next) => {
       const peerForwarded = (req.get('X-Pinokio-Peer') || '').trim().toLowerCase()
@@ -6039,6 +6534,7 @@ class Server {
       preferences: this.appPreferences,
       appSearch: this.appSearch,
       appLogs: this.appLogs,
+      appLogReports: this.appLogReports,
       getTheme: () => this.theme
     })
 
@@ -6103,6 +6599,90 @@ class Server {
       }
     })
     */
+    this.app.get("/autolaunch/candidates", ex(async (req, res) => {
+      const app = await this.getAutolaunchAppById(req.query.app)
+      if (!app) {
+        res.status(404).json({ ok: false, error: "App not found." })
+        return
+      }
+      const state = await this.buildAutolaunchCandidates(app)
+      res.json({ ok: true, ...state })
+    }))
+    this.app.post("/autolaunch", ex(async (req, res) => {
+      const app = await this.getAutolaunchAppById(req.body && req.body.app)
+      if (!app) {
+        res.status(404).json({ ok: false, error: "App not found." })
+        return
+      }
+      const requestedScript = typeof req.body.script === "string" ? req.body.script.trim() : ""
+      if (!requestedScript) {
+        const envInfo = await this.getAutolaunchEnvInfo(app)
+        if (envInfo.exists) {
+          await Util.update_env(envInfo.envPath, {
+            PINOKIO_SCRIPT_AUTOLAUNCH: ""
+          })
+        }
+        res.json({
+          ok: true,
+          app: await this.buildAutolaunchAppState(app)
+        })
+        return
+      }
+
+      const envInfo = await this.getAutolaunchEnvInfo(app)
+      const resolved = await this.resolveAutolaunchScript(envInfo.appRoot, requestedScript)
+      if (!resolved) {
+        res.status(400).json({
+          ok: false,
+          error: "Select an existing local script inside the app."
+        })
+        return
+      }
+      const initialized = await Environment.init({ name: app.id }, this.kernel)
+      await Util.update_env(initialized.env_path, {
+        PINOKIO_SCRIPT_AUTOLAUNCH: resolved.script
+      })
+      res.json({
+        ok: true,
+        app: await this.buildAutolaunchAppState(app)
+      })
+    }))
+    this.app.post("/autolaunch/disable-all", ex(async (req, res) => {
+      const apps = await this.kernel.api.listApps()
+      let disabled = 0
+      for (const app of apps) {
+        const envInfo = await this.getAutolaunchEnvInfo(app)
+        if (envInfo.exists && envInfo.value) {
+          await Util.update_env(envInfo.envPath, {
+            PINOKIO_SCRIPT_AUTOLAUNCH: ""
+          })
+          disabled++
+        }
+      }
+      res.json({
+        ok: true,
+        disabled,
+        apps: await this.buildAutolaunchAppsState()
+      })
+    }))
+    this.app.get("/autolaunch", ex(async (req, res) => {
+      const peerAccess = await this.composePeerAccessPayload()
+      const list = this.getPeers()
+      const apps = await this.buildAutolaunchAppsState()
+      const appsJson = JSON.stringify(apps).replace(/</g, "\\u003c")
+      res.render("autolaunch", {
+        current_host: this.kernel.peer.host,
+        ...peerAccess,
+        apps,
+        appsJson,
+        enabledCount: apps.filter((app) => app.autolaunch_enabled).length,
+        portal: this.portal,
+        logo: this.logo,
+        theme: this.theme,
+        agent: req.agent,
+        list,
+      })
+    }))
     this.app.get("/tools", ex(async (req, res) => {
       const peerAccess = await this.composePeerAccessPayload()
       let list = this.getPeers()
@@ -6744,24 +7324,7 @@ class Server {
       }
     }
     const normalizePluginPath = (value) => {
-      let normalized = typeof value === "string" ? value.trim() : ""
-      if (!normalized) {
-        return ""
-      }
-      normalized = normalized.replace(/\\/g, "/")
-      if (/^https?:\/\//i.test(normalized)) {
-        try {
-          const parsed = new URL(normalized)
-          normalized = parsed.pathname || ""
-        } catch (_) {
-        }
-      }
-      normalized = normalized.replace(/^\/run(?=\/)/, "")
-      if (!normalized.startsWith("/")) {
-        normalized = `/${normalized}`
-      }
-      normalized = normalized.replace(/\/{2,}/g, "/").replace(/\/+$/, "")
-      return normalized
+      return PluginSources.normalizePluginPath(value)
     }
     const normalizePluginLookupKey = (value) => {
       const normalized = normalizePluginPath(value)
@@ -6777,6 +7340,21 @@ class Server {
         : `${trimmed.replace(/\/+$/, "")}/pinokio.js`
     }
     const loadBundledPluginMenu = async () => this.getBundledPluginMenu()
+    const evaluatePluginInstalled = async (pluginItem) => {
+      if (!PluginSources.isInstalledCheck(pluginItem && pluginItem.installed)) {
+        return null
+      }
+      try {
+        const result = await Promise.race([
+          Promise.resolve(pluginItem.installed(this.kernel, this.kernel.info || {})),
+          new Promise((resolve) => setTimeout(() => resolve(null), 1000))
+        ])
+        return typeof result === "boolean" ? result : null
+      } catch (error) {
+        console.warn("Failed to evaluate plugin installed state", pluginItem && pluginItem.title, error)
+        return null
+      }
+    }
     const classifyPluginMenuItem = (pluginItem) => {
       const runs = Array.isArray(pluginItem && pluginItem.run) ? pluginItem.run : []
       const hasExec = runs.some((step) => step && step.method === "exec")
@@ -6793,7 +7371,7 @@ class Server {
       }
       return "cli"
     }
-    const serializePluginMenuItem = (pluginItem, index) => {
+    const serializePluginMenuItem = async (pluginItem, index) => {
       const hrefValue = typeof pluginItem?.href === "string" ? pluginItem.href : ""
       let pluginPath = typeof pluginItem?.src === "string" ? pluginItem.src : ""
       const extraParams = []
@@ -6801,7 +7379,9 @@ class Server {
         try {
           const parsed = new URL(hrefValue.startsWith("http") ? hrefValue : `http://localhost${hrefValue}`)
           if (!pluginPath) {
-            pluginPath = parsed.pathname.replace(/^\/run/, "") || ""
+            pluginPath = PluginSources.isSystemRunPath(parsed.pathname)
+              ? parsed.pathname
+              : (parsed.pathname.replace(/^\/run/, "") || "")
           }
           parsed.searchParams.forEach((value, key) => {
             if (key === "cwd") {
@@ -6816,6 +7396,8 @@ class Server {
       const normalizedPluginPath = normalizePluginPath(pluginPath)
       const category = classifyPluginMenuItem(pluginItem)
       const title = pluginItem?.title || pluginItem?.text || pluginItem?.name || "Plugin"
+      const hasInstalledCheck = PluginSources.isInstalledCheck(pluginItem?.installed)
+      const installed = hasInstalledCheck ? await evaluatePluginInstalled(pluginItem) : null
       return {
         index,
         title,
@@ -6836,9 +7418,11 @@ class Server {
             cwd: typeof pluginItem.ownerApp.cwd === "string" ? pluginItem.ownerApp.cwd : "",
           }
           : null,
-        hasInstall: Array.isArray(pluginItem?.install),
-        hasUninstall: Array.isArray(pluginItem?.uninstall),
-        hasUpdate: Array.isArray(pluginItem?.update),
+        hasInstall: PluginSources.isAction(pluginItem?.install),
+        hasUninstall: PluginSources.isAction(pluginItem?.uninstall),
+        hasUpdate: PluginSources.isAction(pluginItem?.update),
+        hasInstalledCheck,
+        installed,
         category,
         categoryTitle: category === "ide" ? "Desktop Plugin" : "Terminal Plugin",
         categorySubtitle: category === "ide" ? "Launch externally" : "Launch in Pinokio",
@@ -6868,7 +7452,7 @@ class Server {
         console.warn("Failed to load bundled plugins", bundledError)
       }
       const mergedPluginMenu = pluginMenu.concat(bundledPluginMenu)
-      return mergedPluginMenu.map((pluginItem, index) => serializePluginMenuItem(pluginItem, index))
+      return Promise.all(mergedPluginMenu.map((pluginItem, index) => serializePluginMenuItem(pluginItem, index)))
     }
     const buildPluginCategories = (plugins) => {
       const buckets = { ide: [], cli: [] }
@@ -6880,10 +7464,75 @@ class Server {
         }
       })
       return [
-        { key: "ide", title: "Desktop Plugins", subtitle: "Launch externally", items: buckets.ide },
         { key: "cli", title: "Terminal Plugins", subtitle: "Launch in Pinokio", items: buckets.cli },
+        { key: "ide", title: "Desktop Plugins", subtitle: "Launch externally", items: buckets.ide },
       ]
     }
+    const resolveProjectShellWorkspace = (value) => {
+      const requestedWorkspace = typeof value === "string" ? value.trim() : ""
+      if (!requestedWorkspace) {
+        return ""
+      }
+      try {
+        return path.resolve(this.kernel.api.filePath(requestedWorkspace))
+      } catch (error) {
+        return ""
+      }
+    }
+    const serializeProjectShellMenu = async (workspacePath) => {
+      if (!workspacePath) {
+        return null
+      }
+      try {
+        const stat = await fs.promises.stat(workspacePath)
+        if (!stat.isDirectory()) {
+          return null
+        }
+      } catch (error) {
+        return null
+      }
+      try {
+        const terminal = await this.devTerminals(workspacePath)
+        const items = []
+        const addShellOption = (item, group = {}) => {
+          if (!item || typeof item !== "object") {
+            return
+          }
+          if (Array.isArray(item.menu) && item.menu.length > 0) {
+            item.menu.forEach((child) => addShellOption(child, item))
+            return
+          }
+          const href = typeof item.href === "string" ? item.href.trim() : ""
+          if (!href || !href.startsWith("/shell/")) {
+            return
+          }
+          const title = typeof item.title === "string" && item.title.trim()
+            ? item.title.trim()
+            : (typeof item.text === "string" && item.text.trim() ? item.text.trim() : "Shell")
+          items.push({
+            title,
+            text: typeof item.text === "string" ? item.text : title,
+            subtitle: typeof item.subtitle === "string" ? item.subtitle : "",
+            icon: typeof item.icon === "string" && item.icon ? item.icon : (group.icon || terminal.icon || "fa-solid fa-terminal"),
+            href,
+            target: `@${href}`,
+            shellId: typeof item.shell_id === "string" ? item.shell_id : "",
+          })
+        }
+        ;(Array.isArray(terminal.menu) ? terminal.menu : []).forEach((item) => addShellOption(item))
+        if (items.length === 0) {
+          return null
+        }
+        return {
+          title: "Project Shell",
+          subtitle: typeof terminal.subtitle === "string" ? terminal.subtitle : "",
+          items,
+        }
+      } catch (error) {
+        console.warn("Failed to load project shell menu for Ask AI", error)
+        return null
+      }
+    }
     const findPluginByPath = (plugins, targetPath) => {
       const targetKey = normalizePluginLookupKey(targetPath)
       if (!targetKey) {
@@ -6908,7 +7557,7 @@ class Server {
         index: -1,
         title: context.title || "Plugin",
         description: typeof config.description === "string" ? config.description : "",
-        href: `/run${normalizedPluginPath}`,
+        href: PluginSources.pluginRunHrefForPath(normalizedPluginPath),
         link: typeof config.link === "string" ? config.link : "",
         image: context.image || null,
         icon: null,
@@ -6921,6 +7570,8 @@ class Server {
         hasInstall: !!context.hasInstall,
         hasUninstall: !!context.hasUninstall,
         hasUpdate: !!context.hasUpdate,
+        hasInstalledCheck: !!context.hasInstalledCheck,
+        installed: null,
         category,
         categoryTitle: category === "ide" ? "Desktop Plugin" : "Terminal Plugin",
         categorySubtitle: category === "ide" ? "Launch externally" : "Launch in Pinokio",
@@ -6948,9 +7599,20 @@ class Server {
         localLabel: "",
         managedPrefix: "",
       }
+      if (PluginSources.isSystemPluginPath(normalizedPath)) {
+        const relativeSystemPath = normalizedPath.replace(/^\/pinokio\/run\/+/, "")
+        return {
+          ...emptyState,
+          ownership: "system",
+          localLabel: relativeSystemPath,
+        }
+      }
       if (!normalizedPath.startsWith("/plugin/")) {
         return emptyState
       }
+      if (PluginSources.isLegacyPluginCodePath(normalizedPath)) {
+        return emptyState
+      }
       const pluginFilePath = path.resolve(this.kernel.path(normalizedPath.slice(1)))
       if (!isPathInsideRoot(pluginFilePath, pluginRoot)) {
         return emptyState
@@ -7176,6 +7838,11 @@ class Server {
           label: "Local plugin",
           tone: "accent"
         })
+      } else if (ownership === "system") {
+        badges.push({
+          label: "Built-in plugin",
+          tone: "neutral"
+        })
       } else if (ownership === "managed") {
         badges.push({
           label: "Managed by Pinokio",
@@ -7191,6 +7858,17 @@ class Server {
         label: plugin && plugin.category === "ide" ? "Desktop plugin" : "Terminal plugin",
         tone: "neutral"
       })
+      if (plugin && plugin.installed === true) {
+        badges.push({
+          label: "Installed",
+          tone: "accent"
+        })
+      } else if (plugin && plugin.installed === false) {
+        badges.push({
+          label: "Not installed",
+          tone: "warning"
+        })
+      }
       if (remoteLabel) {
         badges.push({
           label: "Remote linked",
@@ -7228,8 +7906,14 @@ class Server {
         sourceValue = shareState.localLabel
         statusValue = changes.length > 0 ? pluralizeTaskFiles(changes.length) : "Updated with Pinokio"
         githubPanelTitle = "Managed by Pinokio"
-        githubPanelCopy = "This plugin lives inside <code>plugin/code</code>, which Pinokio refreshes as part of its managed source. Open the folder if you need to inspect it, but don&apos;t treat it as your own publishable repo."
+        githubPanelCopy = "This plugin lives inside Pinokio-managed source. Open the folder if you need to inspect it, but don&apos;t treat it as your own publishable repo."
         localChangesCopy = "These edits live inside Pinokio-managed source and may be overwritten by future Pinokio updates."
+      } else if (ownership === "system") {
+        sourceLabel = "System plugin"
+        sourceValue = shareState.localLabel || sourceValue
+        statusValue = "Read-only"
+        githubPanelTitle = "Built in to Pinokio"
+        githubPanelCopy = "This plugin ships with Pinokio and is not editable from the local plugin workspace."
       }
       const changePreview = changes.slice(0, 6).map((change) => ({
         file: change && change.file ? change.file : "",
@@ -7272,6 +7956,7 @@ class Server {
     }))
     this.app.get("/plugin", ex(async (req, res) => {
       const requestedPath = typeof req.query.path === "string" ? req.query.path.trim() : ""
+      const requestedCwd = typeof req.query.cwd === "string" ? req.query.cwd.trim() : ""
       if (!requestedPath) {
         res.redirect("/plugins")
         return
@@ -7301,6 +7986,7 @@ class Server {
         ...sidebarContext,
         plugin,
         pluginUi,
+        pluginCwd: requestedCwd,
         shareState,
         apps,
       })
@@ -7337,14 +8023,154 @@ class Server {
     }))
     this.app.get("/api/plugin/menu", ex(async (req, res) => {
       try {
+        const workspacePath = resolveProjectShellWorkspace(req.query.workspace)
         const pluginMenu = await loadSerializedPlugins()
+        const projectShell = await serializeProjectShellMenu(workspacePath)
         res.set("Cache-Control", "no-store")
-        res.json({ menu: pluginMenu })
+        res.json({ menu: pluginMenu, projectShell })
       } catch (error) {
         console.warn('Failed to load plugin menu for create launcher modal', error)
         res.json({ menu: [] })
       }
     }))
+    this.app.get("/api/plugin/install-state", ex(async (req, res) => {
+      const requestedPath = typeof req.query.path === "string" ? req.query.path.trim() : ""
+      if (!requestedPath) {
+        res.status(400).json({
+          ok: false,
+          error: "Plugin path is required."
+        })
+        return
+      }
+      const validation = await contentValidation.validatePluginByPath(requestedPath)
+      if (!validation.valid) {
+        res.status(404).json({
+          ok: false,
+          error: validation.message || "Plugin not found."
+        })
+        return
+      }
+      const context = validation.context && typeof validation.context === "object" ? validation.context : {}
+      const config = context.config && typeof context.config === "object" ? context.config : {}
+      const normalizedPluginPath = normalizePluginPath(context.pluginPath || requestedPath)
+      const hasInstall = PluginSources.isAction(config.install)
+      const hasInstalledCheck = PluginSources.isInstalledCheck(config.installed)
+      const installed = hasInstalledCheck ? await evaluatePluginInstalled(config) : null
+      res.set("Cache-Control", "no-store")
+      res.json({
+        ok: true,
+        title: context.title || "Plugin",
+        pluginPath: normalizedPluginPath,
+        detailUrl: `/plugin?path=${encodeURIComponent(normalizedPluginPath)}`,
+        hasInstall,
+        hasInstalledCheck,
+        installed,
+      })
+    }))
+    const redirectSkills = (res, params = {}) => {
+      const query = new URLSearchParams()
+      if (params.notice) query.set("notice", params.notice)
+      if (params.error) query.set("error", params.error)
+      res.redirect(`/skills${query.toString() ? `?${query.toString()}` : ""}`)
+    }
+    const requireSkillsHome = (res) => {
+      if (this.kernel && this.kernel.homedir) {
+        return true
+      }
+      res.redirect("/home?mode=settings")
+      return false
+    }
+    this.app.get("/skills", ex(async (req, res) => {
+      if (!requireSkillsHome(res)) {
+        return
+      }
+      let skills = []
+      let indexError = ""
+      try {
+        skills = await ManagedSkills.listManagedSkills(this.kernel)
+      } catch (error) {
+        indexError = error && error.message ? error.message : "Failed to read managed skills index."
+      }
+      res.render("skills", {
+        theme: this.theme,
+        agent: req.agent,
+        skills,
+        skillsRootPath: ManagedSkills.skillsRoot(this.kernel),
+        indexPath: ManagedSkills.indexPath(this.kernel),
+        publishRoots: ManagedSkills.publishRoots(),
+        notice: typeof req.query.notice === "string" ? req.query.notice : "",
+        error: typeof req.query.error === "string" ? req.query.error : "",
+        indexError
+      })
+    }))
+    this.app.post("/skills/install", ex(async (req, res) => {
+      if (!requireSkillsHome(res)) {
+        return
+      }
+      try {
+        const skill = await ManagedSkills.installSkillFromGit(this.kernel, {
+          ref: typeof req.body.ref === "string" ? req.body.ref : ""
+        })
+        redirectSkills(res, {
+          notice: skill && skill.valid
+            ? `Downloaded ${skill.label || skill.id}.`
+            : `Downloaded ${skill ? skill.id : "skill"}, but it is invalid.`
+        })
+      } catch (error) {
+        redirectSkills(res, {
+          error: error && error.message ? error.message : "Failed to download skill."
+        })
+      }
+    }))
+    this.app.post("/skills/:id/toggle", ex(async (req, res) => {
+      if (!requireSkillsHome(res)) {
+        return
+      }
+      const id = typeof req.params.id === "string" ? req.params.id : ""
+      const enabled = req.body.enabled === "1" || req.body.enabled === "true"
+      try {
+        const skill = await ManagedSkills.setSkillEnabled(this.kernel, id, enabled)
+        redirectSkills(res, {
+          notice: `${skill && skill.label ? skill.label : id} ${enabled ? "turned on" : "turned off"}.`
+        })
+      } catch (error) {
+        redirectSkills(res, {
+          error: error && error.message ? error.message : "Failed to update skill."
+        })
+      }
+    }))
+    this.app.post("/skills/:id/publish-name", ex(async (req, res) => {
+      if (!requireSkillsHome(res)) {
+        return
+      }
+      const id = typeof req.params.id === "string" ? req.params.id : ""
+      try {
+        const skill = await ManagedSkills.setSkillPublishName(this.kernel, id, req.body.publishName)
+        redirectSkills(res, {
+          notice: `${skill && skill.label ? skill.label : id} syncs as ${skill.publishName}.`
+        })
+      } catch (error) {
+        redirectSkills(res, {
+          error: error && error.message ? error.message : "Failed to update sync folder name."
+        })
+      }
+    }))
+    this.app.post("/skills/:id/remove", ex(async (req, res) => {
+      if (!requireSkillsHome(res)) {
+        return
+      }
+      const id = typeof req.params.id === "string" ? req.params.id : ""
+      try {
+        await ManagedSkills.removeSkill(this.kernel, id)
+        redirectSkills(res, {
+          notice: `${id} removed.`
+        })
+      } catch (error) {
+        redirectSkills(res, {
+          error: error && error.message ? error.message : "Failed to remove skill."
+        })
+      }
+    }))
     this.app.get("/api/tasks", ex(async (req, res) => {
       const query = typeof req.query.q === "string" ? req.query.q.trim().toLowerCase() : ""
       const targetFilter = typeof req.query.target === "string"
@@ -7488,8 +8314,13 @@ class Server {
       const peerAccess = await this.composePeerAccessPayload()
       const list = this.getPeers()
       const workspace = typeof req.query.workspace === 'string' ? req.query.workspace.trim() : ''
+      const embedded = req.query.embed === '1' || req.query.embed === 'true'
+      const requestedView = typeof req.query.view === 'string' ? req.query.view.trim().toLowerCase() : ''
+      const initialView = workspace && requestedView !== 'raw' ? 'latest' : 'raw'
       let context
       const downloadUrl = workspace ? `/pinokio/logs.zip?workspace=${encodeURIComponent(workspace)}` : '/pinokio/logs.zip'
+      const reportUrl = workspace ? `/apps/logs/${encodeURIComponent(workspace)}/report` : ''
+      const draftUrl = workspace ? `/apps/logs/${encodeURIComponent(workspace)}/drafts` : ''
       try {
         context = await this.resolveLogsRoot({ workspace })
       } catch (error) {
@@ -7506,6 +8337,10 @@ class Server {
           logsTitle: workspace || null,
           logsError: error && error.message ? error.message : 'Workspace not found',
           logsDownloadUrl: downloadUrl,
+          logsReportUrl: reportUrl,
+          logsDraftUrl: draftUrl,
+          logsEmbedded: embedded,
+          logsInitialView: initialView,
         })
         return
       }
@@ -7522,6 +8357,10 @@ class Server {
         logsTitle: context.title,
         logsError: null,
         logsDownloadUrl: downloadUrl,
+        logsReportUrl: reportUrl,
+        logsDraftUrl: draftUrl,
+        logsEmbedded: embedded,
+        logsInitialView: initialView,
       })
     }))
     this.app.get("/api/logs/tree", ex(async (req, res) => {
@@ -8094,24 +8933,7 @@ class Server {
       }
       return targetPath
     }
-	    const resolveUniversalLauncherPluginHref = (toolValue) => {
-	      let normalizedTool = typeof toolValue === "string" ? toolValue.trim() : ""
-	      normalizedTool = normalizedTool.replace(/^https?:\/\/[^/]+/i, "")
-	      normalizedTool = normalizedTool.replace(/^\/+|\/+$/g, "")
-	      normalizedTool = normalizedTool.replace(/^run\//, "")
-	      if (!normalizedTool || normalizedTool.includes("..") || !/^[A-Za-z0-9._/-]+$/.test(normalizedTool)) {
-	        const error = new Error("Invalid plugin.")
-	        error.status = 400
-	        throw error
-	      }
-	      if (normalizedTool.startsWith("plugin/") || normalizedTool.startsWith("api/")) {
-	        const scriptPath = normalizedTool.endsWith(".js")
-	          ? normalizedTool
-	          : `${normalizedTool}/pinokio.js`
-	        return `/run/${scriptPath}`
-	      }
-	      return `/run/plugin/${normalizedTool}/pinokio.js`
-	    }
+    const resolveUniversalLauncherPluginHref = PluginSources.resolveLauncherPluginHref
 	    const persistLauncherPromptContext = async (targetPath, options = {}) => {
 	      const prompt = typeof options.prompt === "string" ? options.prompt.trim() : ""
 	      if (!prompt) {
@@ -8390,7 +9212,7 @@ class Server {
         type: "create_app",
         name: folderName,
         cwd: path.resolve(this.kernel.path("api"), folderName),
-        url: response.success
+        url: PluginSources.normalizeLauncherSuccessPlugin(response.success, selectedTool)
       }
     }
     const taskPackages = createTaskPackageService({
@@ -9377,10 +10199,6 @@ class Server {
           res.redirect("/home?mode=settings")
           return
         }
-        const terminalDefaultSkillIds = Array.from(new Set([
-          path.resolve(os.homedir(), ".agents", "skills", "pinokio", "SKILL.md"),
-          path.resolve(os.homedir(), ".agents", "skills", "gepeto", "SKILL.md")
-        ].map((skillPath) => crypto.createHash("sha1").update(skillPath).digest("hex").slice(0, 16))))
         const peerAccess = await this.composePeerAccessPayload()
         res.render("terminals", {
           ...peerAccess,
@@ -9392,7 +10210,7 @@ class Server {
           items: [],
           providers: getTerminalStarterProviders().map((provider) => ({ key: provider.key, label: provider.label })),
           skills: [],
-          defaultSkillIds: terminalDefaultSkillIds,
+          defaultSkillIds: [],
           ishome: false
         })
         return
@@ -12114,15 +12932,16 @@ class Server {
     }))
     this.app.get("/settings/docs/:skill/download", ex(async (req, res) => {
       const skill = typeof req.params.skill === "string" ? req.params.skill.trim().toLowerCase() : ""
-      const docsBySkill = {
-        pinokio: path.resolve(os.homedir(), ".agents", "skills", "pinokio", "SKILL.md"),
-        gepeto: path.resolve(os.homedir(), ".agents", "skills", "gepeto", "SKILL.md"),
+      if (!this.kernel || !this.kernel.homedir) {
+        res.status(404).send("Pinokio home not configured")
+        return
       }
-      const filepath = docsBySkill[skill]
-      if (!filepath) {
+      const managedSkill = await ManagedSkills.getManagedSkill(this.kernel, skill, { sync: false })
+      if (!managedSkill || (skill !== "pinokio" && skill !== "gepeto")) {
         res.status(404).send("Unknown skill")
         return
       }
+      const filepath = managedSkill.path
       try {
         await fs.promises.access(filepath, fs.constants.R_OK)
       } catch (error) {
@@ -12202,10 +13021,11 @@ class Server {
       let md = await fs.promises.readFile(path.resolve(__dirname, "..", "kernel/connect/providers/github/README.md"), "utf8")
       let readme = marked.parse(md)
 
-      let hosts = await this.get_github_hosts()
+      const githubConnection = await this.get_github_connection()
+      let hosts = githubConnection.display
 
       let items
-      if (hosts.length > 0) {
+      if (githubConnection.connected) {
         // logged in => display logout
         items = [{
           icon: "fa-solid fa-circle-xmark",
@@ -12280,7 +13100,7 @@ class Server {
     this.app.get("/github/status", ex(async (req, res) => {
       let id = "gh_status"
       let params = new URLSearchParams()
-      let message = "gh auth status"
+      let message = "git credential-manager github list"
       params.set("message", encodeURIComponent(message))
       params.set("path", this.kernel.homedir)
 //      params.set("kill", "/Logged in/i")
@@ -12294,7 +13114,15 @@ class Server {
     this.app.get("/github/logout", ex(async (req, res) => {
       let id = "gh_logout"
       let params = new URLSearchParams()
-      let message = "gh auth logout"
+      const githubConnection = await this.get_github_connection()
+      let { hadLegacyAuth, message } = await this.github_logout_params(githubConnection)
+      if (!message && hadLegacyAuth) {
+        res.redirect("/github")
+        return
+      }
+      if (!message) {
+        message = "git credential-manager github list"
+      }
       params.set("message", encodeURIComponent(message))
       params.set("path", this.kernel.homedir)
 //      params.set("kill", "/Logged in/i")
@@ -12308,21 +13136,11 @@ class Server {
     this.app.get("/github/login", ex(async (req, res) => {
       let id = "gh_login"
       let params = new URLSearchParams()
-      let delimiter
-      if (this.kernel.platform === "win32") {
-        delimiter = " && "; // must use &&. & doesn't necessariliy wait until the curruent command finishes
-      } else {
-        delimiter = " ; ";
-      }
-      let message = [
-        "gh auth setup-git --hostname github.com --force",
-        "gh auth login --web --clipboard --git-protocol https"
-      ].join(delimiter)
+      const { doneMarker, message } = this.github_login_params()
       params.set("message", encodeURIComponent(message))
       params.set("input", true)
       params.set("path", this.kernel.homedir)
-      params.set("kill", "/Logged in/i")
-//      params.set("kill_message", "Your Github account is now connected.")
+      params.set("kill", `/${doneMarker}/`)
       params.set("callback", encodeURIComponent("/github"))
       params.set("id", id)
       params.set("target", "_top")
@@ -12756,23 +13574,6 @@ class Server {
         })
       }
     }))
-    this.app.post("/plugin/update", ex(async (req, res) => {
-      try {
-        await this.kernel.exec({
-          message: "git pull",
-          path: this.kernel.path("plugin/code")
-        }, (e) => {
-          console.log(e)
-        })
-        res.json({
-          success: true
-        })
-      } catch (e) {
-        res.json({
-          error: e.stack
-        })
-      }
-    }))
     this.app.post("/network/reset", ex(async (req, res) => {
       let caddy_path = this.kernel.path("cache/XDG_DATA_HOME/caddy")
       await rimraf(caddy_path)
@@ -13549,14 +14350,15 @@ class Server {
     this.app.get("/pre/api/:name", ex(async (req, res) => {
       let launcher = await this.kernel.api.launcher(req.params.name)
       let config = launcher.script
-      if (config && config.pre) {
-        config.pre.forEach((item) => {
-          if (item.icon) {
+      if (config && Array.isArray(config.pre)) {
+        const items = config.pre.filter((item) => item && typeof item === "object")
+        items.forEach((item) => {
+          if (typeof item.icon === "string" && item.icon) {
             item.icon = `/api/${req.params.name}/${item.icon}?raw=true`
           } else {
             item.icon = "/pinokio-black.png"
           }
-          if (!item.href.startsWith("http")) {
+          if (typeof item.href === "string" && item.href && !item.href.startsWith("http")) {
             item.href = path.resolve(this.kernel.homedir, "api", req.params.name, item.href)
           }
         })
@@ -13567,7 +14369,7 @@ class Server {
           theme: this.theme,
           agent: req.agent,
           name: req.params.name,
-          items: config.pre,
+          items,
           env
         })
       } else {
@@ -13684,6 +14486,18 @@ class Server {
         res.json({ du: 0 })
       }
     }))
+    this.app.post("/resource-usage/preferences", ex(async (req, res) => {
+      const preferences = await this.resourceUsage.updatePreferences(req.body || {})
+      res.json({ preferences })
+    }))
+    this.app.get("/resource-usage/workspace/:name", ex(async (req, res) => {
+      const usage = await this.resourceUsage.getWorkspaceUsage(req.params.name)
+      if (!usage.ok) {
+        res.status(400).json(usage)
+        return
+      }
+      res.json(usage)
+    }))
     this.app.get("/edit/*", ex(async (req, res) => {
       let pathComponents = req.params[0].split("/")
       let filepath = path.resolve(this.kernel.homedir, req.params[0])
@@ -14053,7 +14867,7 @@ class Server {
               mode = "launch_type.desktop"
             } else if (launchType === "terminal") {
               mode = "launch_type.terminal"
-            } else {
+            } else if (Array.isArray(item.run)) {
               for(let step of item.run) {
                 if (step.method === "exec") {
                   mode = "exec" 
@@ -14068,6 +14882,8 @@ class Server {
                   break
                 }
               }
+            } else if (typeof item.run === "function") {
+              mode = "shell"
             }
             if (mode === "launch_type.desktop" || mode === "exec" || mode === "launch") {
               item.type = "Open"
@@ -14195,8 +15011,11 @@ class Server {
     }))
     this.app.get("/action/:action/*", ex(async (req, res) => {
       const action = typeof req.params.action === 'string' ? req.params.action : ''
-      const pathComponents = req.params[0] ? req.params[0].split("/") : []
-      req.base = this.kernel.homedir
+      const rawComponents = req.params[0] ? req.params[0].split("/").filter(Boolean) : []
+      const actionTarget = PluginSources.normalizeActionPathComponents(rawComponents)
+      const pathComponents = actionTarget.pathComponents
+      req.base = actionTarget.system ? PluginSources.systemRoot(this.kernel) : this.kernel.homedir
+      req.pinokioSystem = actionTarget.system
       req.action = action
       try {
         await this.render(req, res, pathComponents)
@@ -14204,6 +15023,17 @@ class Server {
         res.status(404).send(e.message)
       }
     }))
+    this.app.get(`${PluginSources.SYSTEM_RUN_PREFIX}/*`, ex(async (req, res) => {
+      const runPath = typeof req.params[0] === "string" ? req.params[0] : ""
+      let pathComponents = runPath.split("/")
+      req.base = PluginSources.systemRoot(this.kernel)
+      req.pinokioSystem = true
+      try {
+        await this.render(req, res, pathComponents)
+      } catch (e) {
+        res.status(404).send(e.message)
+      }
+    }))
     this.app.get("/run/*", ex(async (req, res) => {
       const runPath = typeof req.params[0] === "string" ? req.params[0] : ""
       let pathComponents = runPath.split("/")
@@ -14937,7 +15767,7 @@ class Server {
       await this.chrome(req, res, "browse")
     }))
     this.app.get("/p/:name/files", ex(async (req, res) => {
-      await this.chrome(req, res, "files")
+      res.redirect(`/p/${encodeURIComponent(req.params.name)}/dev?pinokio_dev_tab=files`)
     }))
     this.app.get("/p/:name/browse", ex(async (req, res) => {
       await this.chrome(req, res, "browse")
@@ -14970,6 +15800,9 @@ class Server {
           let folderPath = this.kernel.path("cache")
           await fse.remove(folderPath)
           await fs.promises.mkdir(folderPath, { recursive: true }).catch((e) => { })
+          await Environment.ensurePinokioCacheDirs(this.kernel, {
+            throwOnFailure: true
+          })
           res.json({ success: true })
         } else if (req.body.type === 'env') {
           let envpath = this.kernel.path("ENVIRONMENT")
@@ -15629,12 +16462,7 @@ class Server {
     }))
     this.app.get("/bin_ready", ex(async (req, res) => {
       if (this.kernel.bin && !this.kernel.bin.requirements_pending) {
-        let code_exists = await this.kernel.exists("plugin/code")
-        if (code_exists) {
-          res.json({ success: true })
-        } else {
-          res.json({ success: false })
-        }
+        res.json({ success: true })
       } else {
         res.json({ success: false })
       }