pinokiod 7.3.14 → 7.4.0

package/test/workspace-gitignore-path-scoped.test.js

@@ -0,0 +1,256 @@
+const assert = require('node:assert/strict')
+const { execFileSync } = require('node:child_process')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+const test = require('node:test')
+
+const WorkspaceStatusManager = require('../kernel/workspace_status')
+
+const {
+  buildCurrentWorkspaceIgnoreEngine,
+  candidateIgnoredByPathScopedGitignores,
+  currentEngineIgnored,
+  normalizePath,
+} = require('./workspace-gitignore-benchmark')
+
+function run(cmd, args, cwd) {
+  return execFileSync(cmd, args, {
+    cwd,
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      GIT_AUTHOR_NAME: 'Codex Test',
+      GIT_AUTHOR_EMAIL: 'codex-test@example.com',
+      GIT_COMMITTER_NAME: 'Codex Test',
+      GIT_COMMITTER_EMAIL: 'codex-test@example.com',
+      GIT_TERMINAL_PROMPT: '0',
+    },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  }).trim()
+}
+
+function git(args, cwd) {
+  return run('git', args, cwd)
+}
+
+function makeTempRoot(prefix) {
+  return fs.mkdtempSync(path.join(os.tmpdir(), prefix))
+}
+
+function initRepo(repoPath) {
+  fs.mkdirSync(repoPath, { recursive: true })
+  git(['init'], repoPath)
+  git(['config', 'user.name', 'Codex Test'], repoPath)
+  git(['config', 'user.email', 'codex-test@example.com'], repoPath)
+}
+
+function writeFile(filePath, content = 'x\n') {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true })
+  fs.writeFileSync(filePath, content)
+}
+
+function makeRecord(workspaceRoot, repoRoot, repoRelative) {
+  const absolutePath = path.resolve(repoRoot, repoRelative)
+  return {
+    key: `${repoRoot}\0${normalizePath(repoRelative)}`,
+    repoRoot,
+    repoRelative: normalizePath(repoRelative),
+    absolutePath,
+    workspaceRelative: normalizePath(path.relative(workspaceRoot, absolutePath)),
+    statusCode: '??',
+    rawLine: `?? ${normalizePath(repoRelative)}`,
+  }
+}
+
+test('path-scoped candidate honors top-level workspace ignores for deep nested repos', async () => {
+  const root = makeTempRoot('pinokio-gitignore-top-')
+  try {
+    const workspace = path.join(root, 'api', 'foo')
+    const nested = path.join(workspace, 'a', 'b', 'c', 'repo')
+    initRepo(workspace)
+    writeFile(path.join(workspace, '.gitignore'), 'a/b/c/repo/parent-hidden.txt\n')
+    initRepo(nested)
+    writeFile(path.join(nested, 'parent-hidden.txt'))
+    writeFile(path.join(nested, 'visible.txt'))
+
+    const records = [
+      makeRecord(workspace, nested, 'parent-hidden.txt'),
+      makeRecord(workspace, nested, 'visible.txt'),
+    ]
+    const candidate = await candidateIgnoredByPathScopedGitignores(workspace, records)
+
+    assert.equal(candidate.ignored.has(records[0].key), true)
+    assert.equal(candidate.ignored.has(records[1].key), false)
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true })
+  }
+})
+
+test('path-scoped candidate includes intermediate .gitignore files before the leaf repo', async () => {
+  const root = makeTempRoot('pinokio-gitignore-intermediate-')
+  try {
+    const workspace = path.join(root, 'api', 'foo')
+    const middle = path.join(workspace, 'a')
+    const leaf = path.join(middle, 'b', 'c', 'repo')
+    initRepo(workspace)
+    initRepo(middle)
+    writeFile(path.join(middle, '.gitignore'), 'b/c/repo/intermediate-hidden.txt\n')
+    initRepo(leaf)
+    writeFile(path.join(leaf, '.gitignore'), 'leaf-hidden.txt\n')
+    writeFile(path.join(leaf, 'intermediate-hidden.txt'))
+    writeFile(path.join(leaf, 'leaf-hidden.txt'))
+    writeFile(path.join(leaf, 'visible.txt'))
+
+    const records = [
+      makeRecord(workspace, leaf, 'intermediate-hidden.txt'),
+      makeRecord(workspace, leaf, 'leaf-hidden.txt'),
+      makeRecord(workspace, leaf, 'visible.txt'),
+    ]
+    const candidate = await candidateIgnoredByPathScopedGitignores(workspace, records)
+
+    assert.equal(candidate.ignored.has(records[0].key), true)
+    assert.equal(candidate.ignored.has(records[1].key), true)
+    assert.equal(candidate.ignored.has(records[2].key), false)
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true })
+  }
+})
+
+test('path-scoped candidate hides tracked paths the same way current JS filtering does', async () => {
+  const root = makeTempRoot('pinokio-gitignore-no-index-')
+  try {
+    const workspace = path.join(root, 'api', 'foo')
+    initRepo(workspace)
+    writeFile(path.join(workspace, 'tracked-hidden.txt'), 'tracked\n')
+    git(['add', 'tracked-hidden.txt'], workspace)
+    git(['commit', '-m', 'track hidden fixture'], workspace)
+    writeFile(path.join(workspace, '.gitignore'), 'tracked-hidden.txt\n')
+
+    const records = [makeRecord(workspace, workspace, 'tracked-hidden.txt')]
+    const current = currentEngineIgnored((await buildCurrentWorkspaceIgnoreEngine(workspace)).engine, records)
+    const candidate = await candidateIgnoredByPathScopedGitignores(workspace, records)
+
+    assert.equal(current.ignored.has(records[0].key), true)
+    assert.equal(candidate.ignored.has(records[0].key), true)
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true })
+  }
+})
+
+test('path-scoped candidate evaluates symlinked directory paths as strings', async () => {
+  const root = makeTempRoot('pinokio-gitignore-symlink-')
+  try {
+    const workspace = path.join(root, 'api', 'foo')
+    const external = path.join(root, 'external-models')
+    initRepo(workspace)
+    writeFile(path.join(workspace, '.gitignore'), '/models/\n/output/\n')
+    fs.mkdirSync(path.join(workspace, 'models'), { recursive: true })
+    fs.mkdirSync(path.join(external, 'output'), { recursive: true })
+    fs.mkdirSync(path.join(external, 'checkpoints'), { recursive: true })
+    fs.symlinkSync(path.join(external, 'checkpoints'), path.join(workspace, 'models', 'checkpoints'), 'dir')
+    fs.symlinkSync(path.join(external, 'output'), path.join(workspace, 'output'), 'dir')
+
+    const records = [
+      makeRecord(workspace, workspace, 'models/checkpoints/deleted-placeholder'),
+      makeRecord(workspace, workspace, 'output/deleted-placeholder'),
+    ]
+    const current = currentEngineIgnored((await buildCurrentWorkspaceIgnoreEngine(workspace)).engine, records)
+    const candidate = await candidateIgnoredByPathScopedGitignores(workspace, records)
+
+    assert.equal(current.ignored.has(records[0].key), true)
+    assert.equal(candidate.ignored.has(records[0].key), true)
+    assert.equal(current.ignored.has(records[1].key), true)
+    assert.equal(candidate.ignored.has(records[1].key), true)
+    assert.equal(candidate.metrics.checked, records.length)
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true })
+  }
+})
+
+test('candidate filtering matches current workspace pre-scan model on multi-level fixture', async () => {
+  const root = makeTempRoot('pinokio-gitignore-parity-')
+  try {
+    const workspace = path.join(root, 'api', 'foo')
+    const middle = path.join(workspace, 'packages', 'middle')
+    const leaf = path.join(middle, 'runtime', 'leaf')
+    initRepo(workspace)
+    writeFile(path.join(workspace, '.gitignore'), 'workspace-hidden.txt\npackages/middle/runtime/leaf/workspace-leaf-hidden.txt\n')
+    writeFile(path.join(workspace, 'packages', '.gitignore'), 'middle/runtime/leaf/package-hidden.txt\n')
+    initRepo(middle)
+    writeFile(path.join(middle, '.gitignore'), 'runtime/leaf/middle-hidden.txt\n')
+    initRepo(leaf)
+    writeFile(path.join(leaf, '.gitignore'), 'leaf-hidden.txt\n')
+
+    const records = [
+      makeRecord(workspace, workspace, 'workspace-hidden.txt'),
+      makeRecord(workspace, leaf, 'package-hidden.txt'),
+      makeRecord(workspace, leaf, 'workspace-leaf-hidden.txt'),
+      makeRecord(workspace, leaf, 'middle-hidden.txt'),
+      makeRecord(workspace, leaf, 'leaf-hidden.txt'),
+      makeRecord(workspace, leaf, 'visible.txt'),
+    ]
+    for (const record of records) {
+      writeFile(record.absolutePath)
+    }
+
+    const current = currentEngineIgnored((await buildCurrentWorkspaceIgnoreEngine(workspace)).engine, records)
+    const candidate = await candidateIgnoredByPathScopedGitignores(workspace, records)
+    const manager = new WorkspaceStatusManager({ enableWatchers: false })
+    const runtimeIgnored = await manager.filterPathScopedGitIgnored(workspace, records)
+
+    assert.deepEqual(new Set(candidate.ignored), new Set(current.ignored))
+    assert.deepEqual(new Set(runtimeIgnored), new Set(current.ignored))
+    assert.equal(candidate.ignored.has(records[0].key), true)
+    assert.equal(candidate.ignored.has(records[1].key), true)
+    assert.equal(candidate.ignored.has(records[2].key), true)
+    assert.equal(candidate.ignored.has(records[3].key), true)
+    assert.equal(candidate.ignored.has(records[4].key), true)
+    assert.equal(candidate.ignored.has(records[5].key), false)
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true })
+  }
+})
+
+test('path-scoped candidate preserves current leading-slash normalization behavior', async () => {
+  const root = makeTempRoot('pinokio-gitignore-leading-slash-')
+  try {
+    const workspace = path.join(root, 'api', 'foo')
+    initRepo(workspace)
+    writeFile(path.join(workspace, '.gitignore'), '/AGENTS.md\n')
+    writeFile(path.join(workspace, 'app', 'AGENTS.md'))
+
+    const records = [makeRecord(workspace, workspace, 'app/AGENTS.md')]
+    const current = currentEngineIgnored((await buildCurrentWorkspaceIgnoreEngine(workspace)).engine, records)
+    const candidate = await candidateIgnoredByPathScopedGitignores(workspace, records)
+
+    assert.equal(current.ignored.has(records[0].key), true)
+    assert.equal(candidate.ignored.has(records[0].key), true)
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true })
+  }
+})
+
+test('path-scoped candidate preserves current trailing directory path behavior', async () => {
+  const root = makeTempRoot('pinokio-gitignore-trailing-dir-')
+  try {
+    const workspace = path.join(root, 'api', 'foo')
+    initRepo(workspace)
+    writeFile(path.join(workspace, 'app', '.gitignore'), [
+      'demosite/timelines/*',
+      '!demosite/timelines/friendfeed.com/',
+      '!demosite/timelines/friendfeed.com/**',
+      '',
+    ].join('\n'))
+    fs.mkdirSync(path.join(workspace, 'app', 'demosite', 'timelines', 'friendfeed.com'), { recursive: true })
+
+    const records = [makeRecord(workspace, workspace, 'app/demosite/timelines/friendfeed.com')]
+    const current = currentEngineIgnored((await buildCurrentWorkspaceIgnoreEngine(workspace)).engine, records)
+    const candidate = await candidateIgnoredByPathScopedGitignores(workspace, records)
+
+    assert.equal(current.ignored.has(records[0].key), true)
+    assert.equal(candidate.ignored.has(records[0].key), true)
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true })
+  }
+})

package/spec/INSTRUCTION_SYNC.md

@@ -1,432 +0,0 @@
-# Pinokio Instruction Sync
-
-This document defines the intended behavior of Pinokio instruction sync, including generated instruction files, mirrored outputs, and the managed sources that feed them.
-
-Unless explicitly marked non-normative, statements in this document describe behavior that future implementations should preserve.
-
-## Purpose
-
-Fix three related problems with minimal behavioral change:
-
-1. Pinokio updates currently wipe the entire `PINOKIO_HOME/plugin` and `PINOKIO_HOME/prototype` trees, including user-installed content.
-2. Generated instruction files such as `PINOKIO_HOME/AGENTS.md` go stale after first creation.
-3. Git-backed installs can become half-initialized (`.git` exists but working files are missing), which breaks runtime flows such as app creation.
-
-## Sync Inputs and Outputs
-
-### 1. Managed instruction sources
-
-Paths:
-
-- `PINOKIO_HOME/plugin/code`
-- `PINOKIO_HOME/prototype/system`
-- `PINOKIO_HOME/network/system`
-
-Population:
-
-- cloned by Pinokio from upstream Git repositories
-
-Policy:
-
-- On Pinokio version change, refresh these managed repos only.
-- On normal startup, bootstrap only if missing.
-- At runtime, if a needed file inside one of these repos is missing, attempt a targeted Git restore for that path only.
-
-### 2. Managed downloaded instruction sources
-
-Paths:
-
-- `PINOKIO_HOME/prototype/PINOKIO.md`
-- `PINOKIO_HOME/prototype/PTERM.md`
-
-Population:
-
-- downloaded by Pinokio
-
-Policy:
-
-- On Pinokio version change, refresh these two files only.
-- On normal startup, download only if missing.
-
-### 3. Generated instruction outputs
-
-Paths:
-
-- `PINOKIO_HOME/AGENTS.md`
-- `PINOKIO_HOME/CLAUDE.md`
-- `PINOKIO_HOME/GEMINI.md`
-- `PINOKIO_HOME/QWEN.md`
-- `PINOKIO_HOME/.windsurfrules`
-- `PINOKIO_HOME/.cursorrules`
-- `PINOKIO_HOME/.clinerules`
-- `PINOKIO_HOME/.geminiignore`
-
-Population:
-
-- generated by `Environment.init(...)` from `PINOKIO_HOME/prototype/system/AGENTS.md`
-
-User customization input:
-
-- `PINOKIO_HOME/SOUL.md`
-
-Policy:
-
-- `SOUL.md` is the persistent user-editable customization file.
-- The output files above are generated artifacts, not user-owned source files.
-- In v1, this policy applies to the home root only, not app roots.
-- Per-app generated `AGENTS.md` / `CLAUDE.md` / `GEMINI.md` / `QWEN.md` / rule files remain on the current behavior unless explicitly redesigned later.
-- On every home environment initialization, Pinokio must:
-  - ensure `PINOKIO_HOME/SOUL.md` exists; create it as an empty file if missing
-  - render the base instruction template
-  - append a fixed wrapper section that says the following `SOUL.md` content overrides earlier general Pinokio defaults on conflict
-  - append the contents of `SOUL.md`
-  - write each generated output only if its content differs from the desired content
-- `.geminiignore` remains a write-if-changed generated file.
-
-### 4. Managed skills and mirrored instruction outputs
-
-Paths:
-
-- `PINOKIO_HOME/skills/index.json`
-- `PINOKIO_HOME/skills/gepeto/SKILL.md`
-- `PINOKIO_HOME/skills/pinokio/SKILL.md`
-- `~/.agents/skills/gepeto/SKILL.md`
-- `~/.claude/skills/gepeto/SKILL.md`
-- `~/.hermes/skills/gepeto/SKILL.md`
-- `~/.agents/skills/pinokio/SKILL.md`
-- `~/.claude/skills/pinokio/SKILL.md`
-- `~/.hermes/skills/pinokio/SKILL.md`
-
-Population:
-
-- `PINOKIO_HOME/skills/gepeto/SKILL.md` is generated from the current effective `PINOKIO_HOME/AGENTS.md`
-- `PINOKIO_HOME/skills/pinokio/SKILL.md` is generated from the source-controlled file in this repo at `prototype/system/SKILL_PINOKIO.md`
-- enabled managed skills are published into external agent roots during managed skill sync
-
-Policy:
-
-- `PINOKIO_HOME/skills/index.json` is the managed skill source of truth.
-- Built-in skills `pinokio` and `gepeto` are present by default and may be disabled but not removed.
-- Downloaded skills are cloned into `PINOKIO_HOME/skills/<id>` and publish as `pinokio-<id>` by default.
-- Enabled managed skills are published to `~/.agents/skills`, `~/.claude/skills`, and `~/.hermes/skills`.
-- Published copies include a `.pinokio-managed.json` marker.
-- Pinokio may update or remove published copies only when they are marked Pinokio-owned, or when migrating a legacy copy whose `SKILL.md` content matches the generated desired content.
-- If a publish target already contains a non-Pinokio skill, sync must report a conflict and not overwrite it.
-- If a published copy is manually deleted while the skill remains enabled, sync treats that as drift and recreates it.
-
-### 5. Out-of-scope user installs
-
-Paths:
-
-- everything under `PINOKIO_HOME/plugin/*` except `plugin/code`
-- everything under `PINOKIO_HOME/prototype/*` except `prototype/system`, `prototype/PINOKIO.md`, and `prototype/PTERM.md`
-- everything under `PINOKIO_HOME/network/*` except `network/system`
-
-Population:
-
-- installed or created by the user
-
-Policy:
-
-- Never delete or refresh these automatically on Pinokio version change.
-- Never bootstrap over them on startup.
-- Only consider a targeted missing-path Git repair if Pinokio actually tries to use a missing file inside one of these repos.
-
-## Sync Triggers
-
-### A. Pinokio version change
-
-Required behavior:
-
-- refresh `plugin/code`
-- refresh `prototype/system`
-- refresh `network/system`
-- refresh `prototype/PINOKIO.md`
-- refresh `prototype/PTERM.md`
-
-Prohibited behavior:
-
-- delete `PINOKIO_HOME/plugin`
-- delete `PINOKIO_HOME/prototype`
-- touch custom siblings under those roots
-
-Compatibility note:
-
-- Keep the current "delete then let init recreate" model, but narrow it to the specific Pinokio-owned repos and docs above.
-- Do not mark the stored home version as updated until the managed refresh has completed successfully, otherwise a failed refresh can leave the home in a broken state that no longer retries on next startup.
-
-### B. Normal startup
-
-Required behavior:
-
-- bootstrap managed repos/docs only if missing
-- run home environment initialization only after the managed repos/docs needed by that initialization are present
-- regenerate generated instruction outputs from `template + SOUL.md`
-- resync mirror outputs if their source content changed
-
-Prohibited behavior:
-
-- refresh user-owned installs
-- wipe managed repos/docs unless this is a version-change path
-
-Ordering requirement:
-
-- After a version-change cleanup, Pinokio must not rely on the current startup order where `Environment.init({}, kernel)` can run before the async reclone/redownload of managed repos/docs completes.
-- Home output regeneration must either:
-  - run after `plugin/code`, `prototype/system`, `network/system`, `PINOKIO.md`, and `PTERM.md` have been restored
-  - or be rerun once those managed inputs are restored
-
-### C. Runtime missing-file repair
-
-When Pinokio is about to fail because a requested file is missing:
-
-1. Find the nearest existing parent directory of the missing path.
-2. Walk upward until a Git repo root is found.
-3. Verify the requested path is inside that repo.
-4. Choose a usable source ref for restore.
-5. Attempt to restore only the missing path from the repo using Git, not a repo-wide reset.
-6. Retry the original operation once.
-
-Rules:
-
-- never hard reset the whole repo
-- never delete the whole repo as part of runtime repair
-- restore only the missing path or subtree
-- do not assume `HEAD` is usable; the restore ref selection must handle orphan or otherwise broken `HEAD` states
-- if repair fails, continue with the existing error path
-
-Minimum restore-ref strategy:
-
-1. If the current `HEAD` resolves to a commit and contains the requested path, restore from `HEAD`.
-2. Otherwise, if a remote-tracking ref is available, fetch and restore from that ref.
-3. Otherwise, fail without destructive repair.
-
-## Instruction Composition
-
-Generated instruction outputs are built from:
-
-1. rendered base template from `prototype/system/AGENTS.md`
-2. a fixed Pinokio-generated wrapper such as:
-
-```md
-## User Soul
-
-The following instructions come from `SOUL.md`.
-
-If this section conflicts with the general Pinokio defaults earlier in this document, follow this section.
-
-If there is no conflict, follow both.
-```
-
-3. the contents of `PINOKIO_HOME/SOUL.md`
-
-Notes:
-
-- `SOUL.md` itself has no special vendor semantics; Pinokio is responsible for folding it into the real files that tools already read.
-- `SOUL.md` should be appended after the base template so the user override layer appears last and has clearer precedence.
-
-## Instruction Sync Migration
-
-Old behavior:
-
-- users may have edited `PINOKIO_HOME/AGENTS.md` directly because it used to be a persistent file
-
-New behavior:
-
-- `AGENTS.md` and its sibling outputs become generated files
-- `SOUL.md` becomes the persistent customization input
-
-Minimal migration:
-
-- on first rollout, if `SOUL.md` does not exist and an existing generated output appears user-modified, preserve the old file as a backup rather than silently discarding it
-- do not attempt automatic semantic merging of old `AGENTS.md` edits into `SOUL.md`
-- this migration check must run before creating an empty `SOUL.md`, otherwise the "SOUL does not exist" condition becomes useless
-
-## Non-Normative Implementation Notes
-
-The following sections are retained as historical rollout notes from the initial implementation. They are informative only and do not override the behavioral requirements above.
-
-## Appendix A. Initial Code Touch Points
-
-### Version refresh scope
-
-- `server/index.js`
-- narrow the current version-mismatch cleanup logic so it refreshes only the managed repos/docs listed in this spec
-
-### Managed repo/doc bootstrap
-
-- `kernel/plugin.js`
-- `kernel/prototype.js`
-- keep existing bootstrap behavior; rely on the narrower cleanup above
-
-### Generated outputs and `SOUL.md`
-
-- `kernel/environment.js`
-- change generation of `AGENTS.md` / `CLAUDE.md` / `GEMINI.md` / `QWEN.md` / rules from "write if missing" to "ensure `SOUL.md`, compute desired content, write if changed"
-- keep mirror sync in this file
-
-### Runtime targeted Git repair
-
-- `kernel/git.js`
-- add helper(s) to discover a repo root for a path and restore a missing file/subtree only
-
-- `server/index.js`
-- before failing direct file serving for a missing path, attempt targeted repair once
-
-- `kernel/index.js`
-- before failing a missing module load, attempt targeted repair once and retry load
-
-## Non-Goals
-
-- No broad asset-management framework in v1.
-- No UI is required for `SOUL.md`.
-- No attempt to auto-refresh arbitrary user-installed plugins/prototypes on Pinokio version change.
-- No repo-wide `git reset --hard` or equivalent destructive repair flow.
-
-## Appendix B. Initial Implementation Constraints
-
-- Keep code changes as small and localized as possible.
-- Prefer editing existing lifecycle code in place over introducing new architectural layers.
-- Do not add a general asset registry/framework in v1.
-- Keep responsibilities where they already live:
-  - version-refresh scope and sequencing in `server/index.js`
-  - generated output composition in `kernel/environment.js`
-  - targeted Git repair helpers in `kernel/git.js`
-  - retry hooks only at the existing failure points in `server/index.js` and `kernel/index.js`
-- Add a new helper file only if it materially reduces complexity at the touched call sites.
-- Preserve existing behavior for healthy installs unless this spec explicitly changes it.
-- Do not expand the v1 `SOUL.md` behavior beyond home-root generated outputs.
-
-## Appendix C. Initial Rollout Checklist
-
-### 1. Narrow managed refresh scope
-
-File:
-
-- `server/index.js`
-
-Changes:
-
-- replace whole-folder refresh of `PINOKIO_HOME/plugin` with refresh of `PINOKIO_HOME/plugin/code` only
-- replace whole-folder refresh of `PINOKIO_HOME/prototype` with refresh of:
-  - `PINOKIO_HOME/prototype/system`
-  - `PINOKIO_HOME/prototype/PINOKIO.md`
-  - `PINOKIO_HOME/prototype/PTERM.md`
-- keep refresh of `PINOKIO_HOME/network/system`
-- do not touch custom sibling installs under `plugin/`, `prototype/`, or `network/`
-
-### 2. Fix update sequencing
-
-File:
-
-- `server/index.js`
-
-Changes:
-
-- do not mark the stored Pinokio home version as updated until managed refresh has actually succeeded
-- do not rely on the current order where home `Environment.init({}, kernel)` may run before managed repos/docs are restored
-- ensure home output generation runs only after managed inputs are present, or rerun it after those inputs are restored
-
-### 3. Add home-root `SOUL.md` generation
-
-File:
-
-- `kernel/environment.js`
-
-Changes:
-
-- scope this change to the home root only
-- ensure `PINOKIO_HOME/SOUL.md` exists; create it empty if missing
-- read the base template from `PINOKIO_HOME/prototype/system/AGENTS.md`
-- compose final output as:
-  - rendered base template
-  - fixed override wrapper
-  - `SOUL.md` content
-- change home-root output writing from "write if missing" to "write if changed"
-- keep `.geminiignore` on its current write-if-changed behavior
-
-### 4. Preserve current app-root behavior
-
-File:
-
-- `kernel/environment.js`
-
-Changes:
-
-- do not apply `SOUL.md` logic to app-root generated files in v1
-- leave app-root `AGENTS.md` / `CLAUDE.md` / `GEMINI.md` / `QWEN.md` / rule generation on current behavior unless required by a concrete bug
-
-### 5. Move mirror sync behind managed skills
-
-File:
-
-- `kernel/environment.js`
-
-Changes:
-
-- generate built-in managed skill sources under `PINOKIO_HOME/skills`
-- publish only enabled managed skills to external agent roots
-- remove disabled Pinokio-owned published copies
-- preserve user-owned publish target conflicts without overwriting
-
-### 6. Add targeted missing-path Git repair helpers
-
-File:
-
-- `kernel/git.js`
-
-Changes:
-
-- add a helper to find the owning repo root for a missing target path
-- add a helper to restore only the missing path or subtree
-- do not hard reset or delete the repo
-- do not assume `HEAD` is usable
-- support a fallback restore ref strategy when `HEAD` is missing, orphaned, or otherwise unusable
-
-### 7. Hook repair into direct file serving
-
-File:
-
-- `server/index.js`
-
-Changes:
-
-- before failing on a missing direct file path, attempt targeted repair once
-- retry the original file stat/load once after repair
-- if repair fails, preserve the current error path
-
-### 8. Hook repair into module loading
-
-File:
-
-- `kernel/index.js`
-
-Changes:
-
-- before returning a failed module load caused by a missing path, attempt targeted repair once
-- retry the original module load once after repair
-- if repair fails, preserve the current error path
-
-### 9. Add one-time migration protection for old edited home outputs
-
-File:
-
-- `kernel/environment.js`
-
-Changes:
-
-- before first rollout regeneration, detect whether an existing home `AGENTS.md` looks user-modified
-- if so, preserve it as a backup instead of silently replacing it
-- do not attempt automatic semantic merge into `SOUL.md`
-- run this check before auto-creating `SOUL.md`
-
-### 10. Verify the changed paths only
-
-Acceptance criteria:
-
-- version update no longer deletes custom installs under `plugin/*`, `prototype/*`, or `network/*`
-- home-root `AGENTS.md` family updates when the base template changes
-- home-root customization survives via `SOUL.md`
-- `pinokio` skill still comes from repo-local `prototype/system/SKILL_PINOKIO.md`
-- missing-file recovery works for a git-backed repo with a missing working-tree path
-- healthy installs behave the same as before