pinokiod 8.0.38 → 8.0.39

package/kernel/vault/hash_worker.js

@@ -2,10 +2,15 @@ const { parentPort } = require('worker_threads')
 const crypto = require('crypto')
 const fs = require('fs')
 
+// Large model files otherwise generate a very high number of 64 KiB stream
+// events. This changes only the read granularity; every byte still feeds the
+// same sha256 digest, one file at a time.
+const HASH_READ_SIZE = 1024 * 1024
+
 parentPort.on('message', ({ id, filePath }) => {
   const hash = crypto.createHash('sha256')
   let size = 0
-  const stream = fs.createReadStream(filePath)
+  const stream = fs.createReadStream(filePath, { highWaterMark: HASH_READ_SIZE })
   stream.on('data', (chunk) => {
     size += chunk.length
     hash.update(chunk)

package/kernel/vault/sweeper.js

@@ -12,8 +12,26 @@ const fastq = require('fastq')
 
 const SHA256_RE = /^[0-9a-f]{64}$/
 const TMP_SUFFIX = ".pinokio-dedup-tmp"
+const DIR_CONCURRENCY = 8
 const STAT_CONCURRENCY = 32
 
+const fileSnapshot = (st) => ({
+  dev: st.dev,
+  ino: st.ino,
+  size: st.size,
+  mtime: st.mtimeMs,
+  ctime: st.ctimeMs
+})
+
+const sameSnapshot = (snapshot, st) => !!(
+  snapshot && st &&
+  snapshot.dev === st.dev &&
+  snapshot.ino === st.ino &&
+  snapshot.size === st.size &&
+  snapshot.mtime === st.mtimeMs &&
+  snapshot.ctime === st.ctimeMs
+)
+
 class Sweeper {
   constructor(vault) {
     this.vault = vault
@@ -23,14 +41,20 @@ class Sweeper {
     this.hashQueue = fastq.promise(this, this._hashJob, 1)
     this.stats = { hashes: 0, ingested: 0 }
     this.statConcurrency = vault.statConcurrency || STAT_CONCURRENCY
+    this.dirConcurrency = vault.dirConcurrency || DIR_CONCURRENCY
     this.metadataBaseCache = new Map()
+    this.hashJobsByIno = new Map()
   }
   idleState() {
     return {
       active: false, dirs: 0, files: 0, bytes_total: 0,
       home_bytes_total: 0, source_bytes: {},
-      candidates: 0, hashed: 0, hash_bytes: 0, queued: 0,
-      started: null, duration_ms: null
+      candidates: 0, hashed: 0, hash_total: 0, hash_bytes: 0, queued: 0,
+      inode_reuses: 0, unstable_hashes: 0,
+      source_ids: [], estimated_files: null, estimated_walk_weight: null,
+      started: null, duration_ms: null,
+      walk_duration_ms: null, hash_wait_duration_ms: null,
+      hash_duration_ms: 0
     }
   }
   // The one entry point: the Pinokio home plus explicit linked imports.
@@ -38,12 +62,35 @@ class Sweeper {
     if (this.state.active) return { already_running: true }
     this.state = Object.assign(this.idleState(), { active: true, started: Date.now() })
     this.metadataBaseCache.clear()
+    this.hashJobsByIno.clear()
     try {
       await this.vault.refreshSources()
-      for (const source of this.vault.scanRoots()) {
+      const scanRoots = this.vault.scanRoots()
+      this.state.source_ids = scanRoots.map((source) => source.source_id).sort()
+      const previous = this.vault.registry.lastScan
+      const previousSourceIds = previous
+        ? (Array.isArray(previous.source_ids) ? previous.source_ids : Object.keys(previous.source_bytes || {})).slice().sort()
+        : []
+      const sameSources = previousSourceIds.length === this.state.source_ids.length &&
+        previousSourceIds.every((sourceId, index) => sourceId === this.state.source_ids[index])
+      if (previous && previous.files > 0 && sameSources) {
+        this.state.estimated_files = previous.files
+        const measuredWeight = previous.duration_ms > 0 && previous.walk_duration_ms >= 0
+          ? previous.walk_duration_ms / previous.duration_ms
+          : 0.8
+        this.state.estimated_walk_weight = Math.max(0.15, Math.min(0.98, measuredWeight))
+      }
+      const walkStarted = Date.now()
+      for (const source of scanRoots) {
+        if (!Object.prototype.hasOwnProperty.call(this.state.source_bytes, source.source_id)) {
+          this.state.source_bytes[source.source_id] = 0
+        }
         await this.walk(source.root, source.source_id === "pinokio" ? null : source.source_id)
       }
+      this.state.walk_duration_ms = Date.now() - walkStarted
+      const hashWaitStarted = Date.now()
       await this.settle()
+      this.state.hash_wait_duration_ms = Date.now() - hashWaitStarted
       this.state.duration_ms = Date.now() - this.state.started
       this.vault.registry.setLastScan({
         ts: Date.now(),
@@ -52,12 +99,23 @@ class Sweeper {
         bytes_total: this.state.bytes_total,
         home_bytes_total: this.state.home_bytes_total,
         source_bytes: Object.assign({}, this.state.source_bytes),
+        source_ids: this.state.source_ids.slice(),
         candidates: this.state.candidates,
         hashed: this.state.hashed,
+        hash_total: this.state.hash_total,
         hash_bytes: this.state.hash_bytes,
+        inode_reuses: this.state.inode_reuses,
+        unstable_hashes: this.state.unstable_hashes,
+        walk_duration_ms: this.state.walk_duration_ms,
+        hash_wait_duration_ms: this.state.hash_wait_duration_ms,
+        hash_duration_ms: this.state.hash_duration_ms,
         duration_ms: this.state.duration_ms
       })
     } finally {
+      // A failed walk must not leave background hash work or per-scan inode
+      // state alive when the next manual scan starts.
+      await this.settle().catch(() => {})
+      this.hashJobsByIno.clear()
       this.state.active = false
     }
     return {
@@ -72,30 +130,45 @@ class Sweeper {
     const vaultRoot = this.vault.root
     const stack = [root]
     while (stack.length) {
-      const dir = stack.pop()
-      this.state.dirs += 1
-      let entries
-      try {
-        entries = await fs.promises.readdir(dir, { withFileTypes: true })
-      } catch (e) {
-        continue
+      const dirs = []
+      while (dirs.length < this.dirConcurrency && stack.length) {
+        dirs.push(stack.pop())
       }
-      // HF hub blobs dir: filenames ARE sha256 for LFS files — no hashing.
-      if (path.basename(dir) === "blobs" && /^(models|datasets|spaces)--/.test(path.basename(path.dirname(dir)))) {
-        await this.ingestHfBlobs(dir, entries, preferredSourceId)
-        continue
-      }
-      for (const entry of entries) {
-        if (entry.isSymbolicLink()) continue
-        const full = path.resolve(dir, entry.name)
-        if (entry.isDirectory()) {
-          if (full === vaultRoot) continue
-          stack.push(full)
+      const directoryResults = await Promise.all(dirs.map(async (dir) => {
+        this.state.dirs += 1
+        try {
+          const entries = await fs.promises.readdir(dir, { withFileTypes: true })
+          return { dir, entries }
+        } catch (e) {
+          return { dir, entries: null }
+        }
+      }))
+      const files = []
+      const hfDirectories = []
+      for (const { dir, entries } of directoryResults) {
+        if (!entries) continue
+        // HF hub blobs dir: filenames ARE sha256 for LFS files — no hashing.
+        if (path.basename(dir) === "blobs" && /^(models|datasets|spaces)--/.test(path.basename(path.dirname(dir)))) {
+          hfDirectories.push({ dir, entries })
+          continue
+        }
+        for (const entry of entries) {
+          if (entry.isSymbolicLink()) continue
+          const full = path.resolve(dir, entry.name)
+          if (entry.isDirectory()) {
+            if (full === vaultRoot) continue
+            stack.push(full)
+          } else if (entry.isFile()) {
+            files.push(full)
+          }
         }
       }
-      const files = entries.filter((entry) => entry.isFile() && !entry.isSymbolicLink())
-        .map((entry) => path.resolve(dir, entry.name))
+      // One metadata pool is shared by all files in this directory batch, so
+      // trees made of many small directories still use the bounded workers.
       await this.considerFiles(files, preferredSourceId)
+      for (const { dir, entries } of hfDirectories) {
+        await this.ingestHfBlobs(dir, entries, preferredSourceId)
+      }
     }
   }
   async considerFiles(filePaths, preferredSourceId = null) {
@@ -165,20 +238,63 @@ class Sweeper {
       await this.classify(filePath, st, harvested, sourceId)
       return
     }
+    // Only coalesce an inode which the filesystem itself reports as having
+    // multiple names. This avoids trusting placeholder inode values on
+    // filesystems which do not expose usable identity metadata.
+    const reusableInode = st.nlink > 1 && st.ino !== undefined && st.ino !== 0
+    const inodeKey = reusableInode ? registry.inoKey(st.dev, st.ino) : null
+    const existingJob = inodeKey ? this.hashJobsByIno.get(inodeKey) : null
+    const name = { filePath, source_id: sourceId, expected: fileSnapshot(st) }
+    if (existingJob) {
+      existingJob.names.push(name)
+      this.state.inode_reuses += 1
+      return
+    }
+    const job = { inodeKey, names: [name] }
+    if (inodeKey) this.hashJobsByIno.set(inodeKey, job)
+    this.state.hash_total += 1
     this.state.queued += 1
-    this.hashQueue.push({ filePath, source_id: sourceId }).catch(() => {})
+    this.hashQueue.push(job).catch(() => {})
   }
-  async _hashJob({ filePath, source_id }) {
-    this.currentHash = { path: filePath }
+  async _hashJob(job) {
+    const primary = job.names[0]
+    const started = Date.now()
+    this.currentHash = { path: primary.filePath }
     try {
-      const { hash, size } = await this.vault.hashFile(filePath)
+      const { hash, size } = await this.vault.hashFile(primary.filePath)
       this.stats.hashes += 1
       this.state.hashed += 1
       this.state.hash_bytes += size || 0
-      const st = await fs.promises.stat(filePath)
-      await this.classify(filePath, st, hash, source_id)
+      const primaryStat = await fs.promises.stat(primary.filePath)
+      // Never publish a digest if the path changed while its bytes were read.
+      // The next manual scan can retry a continuously-mutating file safely.
+      if (size !== primaryStat.size || !sameSnapshot(primary.expected, primaryStat)) {
+        this.state.unstable_hashes += 1
+        return
+      }
+      let index = 0
+      while (index < job.names.length) {
+        const name = job.names[index++]
+        let st
+        try {
+          st = name === primary ? primaryStat : await fs.promises.stat(name.filePath)
+        } catch (e) {
+          continue
+        }
+        // Same (device, inode) is physical identity, not a content guess.
+        // Size and mtime also prevent applying a completed digest after an
+        // in-place mutation. ctime is omitted here because adoption itself
+        // adds a name and therefore legitimately changes inode metadata.
+        if (st.dev !== primaryStat.dev || st.ino !== primaryStat.ino ||
+            st.size !== primaryStat.size || st.mtimeMs !== primaryStat.mtimeMs) continue
+        await this.classify(name.filePath, st, hash, name.source_id)
+      }
     } catch (e) {
     } finally {
+      this.state.hash_duration_ms += Date.now() - started
+      if (job.inodeKey && this.hashJobsByIno.get(job.inodeKey) === job) {
+        this.hashJobsByIno.delete(job.inodeKey)
+      }
       this.currentHash = null
       this.state.queued = Math.max(0, this.state.queued - 1)
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.0.38",
+  "version": "8.0.39",
   "description": "",
   "main": "index.js",
   "scripts": {

package/server/index.js

@@ -15747,6 +15747,13 @@ class Server {
       res.json(await vault.status())
     }))
     this.app.get("/vault", ex(async (req, res) => {
+      const { install_required, requirements_pending } = await this.kernel.bin.check({
+        bin: this.kernel.bin.preset("dev"),
+      })
+      if (requirements_pending || install_required) {
+        res.redirect(`/setup/dev?callback=${encodeURIComponent(req.originalUrl)}`)
+        return
+      }
       res.render("vault", { theme: this.theme, agent: req.agent })
     }))
     this.app.post("/vault/action", ex(async (req, res) => {

package/server/views/vault.ejs

@@ -191,6 +191,10 @@ button.vault-metric:focus-visible,
   border-bottom: 1px solid var(--task-border);
   font-size: 12.5px;
 }
+.vault-scan-state {
+  position: relative;
+  overflow: hidden;
+}
 .vault-scan-state.show,
 .vault-result.show,
 .vault-feedback.show { display: flex; }
@@ -199,6 +203,48 @@ button.vault-metric:focus-visible,
 .vault-result strong { font-weight: 650; }
 .vault-result-detail,
 .vault-scan-detail { color: var(--task-muted); }
+.vault-scan-detail {
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.vault-scan-percent {
+  flex: 0 0 auto;
+  margin-left: auto;
+  color: var(--task-muted);
+  font-size: 11.5px;
+  font-variant-numeric: tabular-nums;
+  font-weight: 650;
+}
+.vault-progress-track {
+  position: absolute;
+  right: 0;
+  bottom: 0;
+  left: 0;
+  height: 2px;
+  overflow: hidden;
+  background: color-mix(in srgb, var(--task-accent) 12%, transparent);
+}
+.vault-progress-bar {
+  display: block;
+  width: 100%;
+  height: 100%;
+  background: var(--task-accent);
+  transform-origin: left center;
+}
+.vault-progress-bar.determinate {
+  transform: scaleX(var(--vault-progress, 0));
+  transition: transform 320ms cubic-bezier(.22, 1, .36, 1);
+}
+.vault-progress-bar.indeterminate {
+  transform: scaleX(1);
+  animation: vault-progress-pulse 1.4s ease-in-out infinite;
+}
+@keyframes vault-progress-pulse {
+  0%, 100% { opacity: .22; }
+  50% { opacity: .78; }
+}
 .vault-result .vault-button { min-height: 28px; margin-left: auto; padding: 4px 10px; }
 .vault-feedback { min-height: 34px; background: var(--task-soft); }
 .vault-feedback.error { color: var(--vault-warning); }
@@ -563,6 +609,12 @@ button.vault-metric:focus-visible,
 }
 @media (prefers-reduced-motion: reduce) {
   .vault-page * { scroll-behavior: auto !important; }
+  .vault-progress-bar { transition: none; }
+  .vault-progress-bar.indeterminate {
+    animation: none;
+    opacity: .5;
+    transform: scaleX(1);
+  }
 }
 </style>
 </head>
@@ -657,6 +709,9 @@ const COPY = {
   repairing: "Repairing…",
   repair_done: "Vault index repaired",
   scan_progress: "Scanning your configured locations",
+  scan_analyzing: "Analyzing large files",
+  scan_finishing: "Finishing scan",
+  scan_estimate_help: "Estimated from your last completed scan",
   scan_folders: "folders checked",
   scan_files: "files checked",
   analyzing: "analyzing",
@@ -1225,11 +1280,29 @@ const renderOverview = () => {
   const scanState = el("vault-scan-state")
   if (scanning) {
     const scan = data.scan
+    const walking = scan.walk_duration_ms == null
+    const hashTotal = scan.hash_total || 0
+    const hashDone = Math.min(scan.hashed || 0, hashTotal)
+    const hashRatio = hashTotal ? Math.min(1, hashDone / hashTotal) : 1
+    const phase = walking ? COPY.scan_progress : hashTotal ? COPY.scan_analyzing : COPY.scan_finishing
+    const hasEstimate = Number.isFinite(scan.estimated_files) && scan.estimated_files > 0
+    const walkWeight = Number.isFinite(scan.estimated_walk_weight) ? scan.estimated_walk_weight : 0.8
+    const walkRatio = hasEstimate ? Math.min(1, (scan.files || 0) / scan.estimated_files) : null
+    const progressRatio = walking
+      ? (hasEstimate ? walkRatio * walkWeight : null)
+      : (hasEstimate ? walkWeight + ((1 - walkWeight) * hashRatio) : hashRatio)
+    const progressValue = progressRatio == null ? null : Math.max(0, Math.min(100, Math.round(progressRatio * 100)))
     const details = [`${scan.dirs || 0} ${COPY.scan_folders}`, `${scan.files || 0} ${COPY.scan_files}`, fmt(scan.bytes_total || 0)]
     if (scan.current_file) details.push(`${COPY.analyzing} ${scan.current_file}`)
-    if (scan.queued > 1) details.push(`${scan.queued} ${COPY.waiting}`)
+    if (walking && scan.queued > 1) details.push(`${scan.queued} ${COPY.waiting}`)
+    const estimated = hasEstimate && progressValue < 100
+    const percent = progressValue == null ? "" : `<span class="vault-scan-percent"${estimated ? ` title="${attr(COPY.scan_estimate_help)}"` : ""}>${estimated ? "~" : ""}${progressValue}%</span>`
+    const progressAttrs = progressValue == null
+      ? `role="progressbar" aria-label="${attr(phase)}"`
+      : `role="progressbar" aria-label="${attr(phase)}" aria-valuemin="0" aria-valuemax="100" aria-valuenow="${progressValue}"${estimated ? ` aria-valuetext="${attr(`About ${progressValue} percent. ${COPY.scan_estimate_help}.`)}"` : ""}`
+    const progressStyle = progressValue == null ? "" : ` style="--vault-progress:${progressRatio}"`
     scanState.classList.add("show")
-    scanState.innerHTML = `<i class="fa-solid fa-circle-notch fa-spin"></i><strong>${esc(COPY.scan_progress)}</strong><span class="vault-scan-detail">${esc(details.join(" · "))}</span>`
+    scanState.innerHTML = `<i class="fa-solid fa-circle-notch fa-spin"></i><strong>${esc(phase)}</strong><span class="vault-scan-detail">${esc(details.join(" · "))}</span>${percent}<span class="vault-progress-track" ${progressAttrs}><span class="vault-progress-bar ${progressValue == null ? "indeterminate" : "determinate"}"${progressStyle}></span></span>`
   } else {
     scanState.classList.remove("show")
     scanState.innerHTML = ""

package/test/vault-sweep.test.js

@@ -48,6 +48,10 @@ describe('vault manual scan (phase 3)', () => {
     assert.ok(result.bytes_total >= content.length + 4, 'folder total includes small files')
     assert.ok(vault.registry.lastScan && vault.registry.lastScan.bytes_total === result.bytes_total)
     assert.ok(vault.registry.lastScan.duration_ms >= 0, 'scan duration is measured')
+    assert.ok(vault.registry.lastScan.walk_duration_ms >= 0, 'walk duration is measured')
+    assert.ok(vault.registry.lastScan.hash_duration_ms >= 0, 'hash duration is measured')
+    assert.strictEqual(vault.registry.lastScan.hash_total, 1, 'hash work has a determinate total after walking')
+    assert.deepStrictEqual(vault.registry.lastScan.source_ids, ['pinokio'], 'scan source set is recorded for later estimates')
   })
 
   test('scans NEVER convert: every byte-identical copy is pending, even in HF caches', async () => {
@@ -163,15 +167,17 @@ describe('vault manual scan (phase 3)', () => {
     await writeFile(path.resolve(home, 'api', 'appA', 'm.bin'), crypto.randomBytes(4096))
     await vault.sweeper.scan()
     const after = vault.sweeper.stats.hashes
+    const priorFiles = vault.registry.lastScan.files
     await vault.sweeper.scan()
     assert.strictEqual(vault.sweeper.stats.hashes, after)
+    assert.strictEqual(vault.sweeper.state.estimated_files, priorFiles, 'same-source rescan uses the prior exact file count')
   })
 
   test('file metadata inspection uses bounded concurrency without changing results', async () => {
     const { home, vault } = await makeEnv()
     const dir = path.resolve(home, 'api', 'bulk')
     await Promise.all(Array.from({ length: 48 }, (_, index) =>
-      writeFile(path.resolve(dir, `small-${index}.txt`), 'x')))
+      writeFile(path.resolve(dir, `dir-${index}`, 'small.txt'), 'x')))
     const realStat = fs.promises.stat
     let active = 0
     let maximum = 0
@@ -194,9 +200,53 @@ describe('vault manual scan (phase 3)', () => {
       fs.promises.stat = realStat
     }
     assert.ok(maximum > 1, `expected concurrent metadata reads, saw ${maximum}`)
+    assert.ok(maximum <= vault.statConcurrency, `metadata concurrency exceeded its bound: ${maximum}`)
     assert.strictEqual(vault.registry.lastScan.files >= 48, true)
   })
 
+  test('multiple names for one inode share one exact hash job', async () => {
+    const { home, vault } = await makeEnv()
+    const content = crypto.randomBytes(4096)
+    const a = await writeFile(path.resolve(home, 'api', 'appA', 'model.bin'), content)
+    const b = path.resolve(home, 'api', 'appB', 'model.bin')
+    await fs.promises.mkdir(path.dirname(b), { recursive: true })
+    await fs.promises.link(a, b)
+
+    await vault.sweeper.scan()
+
+    assert.strictEqual(vault.registry.lastScan.hashed, 1, 'physical content was hashed once')
+    assert.strictEqual(vault.registry.lastScan.inode_reuses, 1, 'second name reused the inode hash job')
+    assert.strictEqual(vault.registry.duplicates.size, 0, 'existing hard links are already shared')
+    assert.strictEqual(vault.registry.links.get(a).hash, sha256(content))
+    assert.strictEqual(vault.registry.links.get(b).hash, sha256(content))
+  })
+
+  test('a file changed during hashing never publishes the stale digest', async () => {
+    const { home, vault } = await makeEnv()
+    const original = crypto.randomBytes(4096)
+    const oldHash = sha256(original)
+    const file = await writeFile(path.resolve(home, 'api', 'appA', 'changing.bin'), original)
+    const realHashFile = vault.hashFile.bind(vault)
+    vault.hashFile = async (target) => {
+      const result = await realHashFile(target)
+      await fs.promises.writeFile(target, crypto.randomBytes(original.length))
+      const future = new Date(Date.now() + 2000)
+      await fs.promises.utimes(target, future, future)
+      return result
+    }
+
+    try {
+      await vault.sweeper.scan()
+    } finally {
+      vault.hashFile = realHashFile
+    }
+
+    assert.strictEqual(vault.registry.lastScan.unstable_hashes, 1)
+    assert.strictEqual(vault.registry.blobs.has(oldHash), false, 'stale digest was discarded')
+    assert.strictEqual(vault.registry.scanIndex.has(file), false, 'unstable path remains unclassified')
+    assert.strictEqual((await fs.promises.stat(file)).nlink, 1, 'unstable file was not adopted')
+  })
+
   test('conversion tmp files are never candidates', async () => {
     const { home, vault } = await makeEnv()
     const stray = await writeFile(path.resolve(home, 'api', 'appA', 'm.bin.pinokio-dedup-tmp'), crypto.randomBytes(4096))

package/test/vault-ui.test.js

@@ -204,6 +204,16 @@ describe('vault dashboard backend (phase 4)', () => {
     assert.doesNotMatch(vaultPage, /Matching locations/)
     assert.match(vaultPage, /scan_waiting:\s*"Waiting for scan results"/)
     assert.match(vaultPage, /view === "all" && !scanning \? `<button class="vault-button" type="button" id="btn-empty-scan"/)
+    assert.match(vaultPage, /class="vault-progress-track"/)
+    assert.match(vaultPage, /role="progressbar"/)
+    assert.match(vaultPage, /scan\.walk_duration_ms == null/)
+    assert.match(vaultPage, /const hashTotal = scan\.hash_total/)
+    assert.match(vaultPage, /const hasEstimate = Number\.isFinite\(scan\.estimated_files\)/)
+    assert.match(vaultPage, /scan_estimate_help:\s*"Estimated from your last completed scan"/)
+    assert.match(vaultPage, /\$\{estimated \? "~" : ""\}\$\{progressValue\}%/)
+    assert.match(vaultPage, /\.vault-progress-bar\.determinate \{[\s\S]*?transform:\s*scaleX/)
+    assert.match(vaultPage, /\.vault-progress-bar\.indeterminate \{[\s\S]*?transform:\s*scaleX\(1\)[\s\S]*?animation:\s*vault-progress-pulse/)
+    assert.doesNotMatch(vaultPage, /vault-progress-sweep/)
     assert.match(vaultPage, /body\.vault-page \.task-container \{[\s\S]*?overflow:\s*hidden/)
     assert.match(vaultPage, /\.vault-explorer \{[\s\S]*?flex:\s*1 1 auto[\s\S]*?overflow:\s*hidden/)
     assert.match(vaultPage, /\.vault-rail \{[\s\S]*?overflow-y:\s*auto[\s\S]*?overscroll-behavior:\s*contain/)
@@ -217,6 +227,19 @@ describe('vault dashboard backend (phase 4)', () => {
     assert.match(vaultPage, /vault-source-line depth-\$\{Math\.min\(depth, 2\)\} \$\{pathText \? "has-path" : ""\}/)
   })
 
+  test('vault route provisions the dev requirements needed by its folder picker', async () => {
+    const serverSource = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'index.js'), 'utf8')
+    const routeStart = serverSource.indexOf('this.app.get("/vault"')
+    const routeEnd = serverSource.indexOf('this.app.post("/vault/action"', routeStart)
+    assert.ok(routeStart >= 0 && routeEnd > routeStart, 'vault route must be present')
+    const route = serverSource.slice(routeStart, routeEnd)
+    assert.match(route, /this\.kernel\.bin\.check\(/)
+    assert.match(route, /this\.kernel\.bin\.preset\("dev"\)/)
+    assert.match(route, /requirements_pending \|\| install_required/)
+    assert.match(route, /\/setup\/dev\?callback=\$\{encodeURIComponent\(req\.originalUrl\)\}/)
+    assert.ok(route.indexOf('res.redirect') < route.indexOf('res.render("vault"'), 'requirements redirect must happen before rendering Vault')
+  })
+
   test('deduplicate batches share a batch id and are undoable as one', async () => {
     const { home, vault } = await makeEnv()
     const c1 = crypto.randomBytes(4096)