pinokiod 8.0.39 → 8.0.40

package/test/vault-sweep.test.js

@@ -1,336 +0,0 @@
-const { test, describe, after } = require('node:test')
-const assert = require('node:assert')
-const fs = require('fs')
-const os = require('os')
-const path = require('path')
-const crypto = require('crypto')
-const Vault = require('../kernel/vault')
-
-const sha256 = (buf) => crypto.createHash('sha256').update(buf).digest('hex')
-
-const writeFile = async (p, content) => {
-  await fs.promises.mkdir(path.dirname(p), { recursive: true })
-  await fs.promises.writeFile(p, content)
-  return p
-}
-
-describe('vault manual scan (phase 3)', () => {
-  let homes = []
-  const makeEnv = async () => {
-    const home = await fs.promises.mkdtemp(path.resolve(os.tmpdir(), 'pinokio-scan-'))
-    homes.push(home)
-    await fs.promises.mkdir(path.resolve(home, 'api'), { recursive: true })
-    const kernel = {
-      homedir: home,
-      platform: process.platform,
-      path: (...args) => path.resolve(home, ...args)
-    }
-    const vault = new Vault(kernel)
-    await vault.init()
-    vault.sizeThreshold = 1024
-    kernel.vault = vault
-    return { home, vault, kernel }
-  }
-  after(async () => {
-    for (const h of homes) {
-      await fs.promises.rm(h, { recursive: true, force: true }).catch(() => {})
-    }
-  })
-
-  test('scan discovers, hashes, adopts — and records folder totals', async () => {
-    const { home, vault } = await makeEnv()
-    const content = crypto.randomBytes(4096)
-    const file = await writeFile(path.resolve(home, 'api', 'appA', 'models', 'm.safetensors'), content)
-    await writeFile(path.resolve(home, 'api', 'appA', 'small.txt'), 'tiny')
-    const result = await vault.sweeper.scan()
-    assert.strictEqual((await fs.promises.stat(file)).nlink, 2)
-    assert.ok(vault.registry.blobs.has(sha256(content)))
-    assert.ok(result.bytes_total >= content.length + 4, 'folder total includes small files')
-    assert.ok(vault.registry.lastScan && vault.registry.lastScan.bytes_total === result.bytes_total)
-    assert.ok(vault.registry.lastScan.duration_ms >= 0, 'scan duration is measured')
-    assert.ok(vault.registry.lastScan.walk_duration_ms >= 0, 'walk duration is measured')
-    assert.ok(vault.registry.lastScan.hash_duration_ms >= 0, 'hash duration is measured')
-    assert.strictEqual(vault.registry.lastScan.hash_total, 1, 'hash work has a determinate total after walking')
-    assert.deepStrictEqual(vault.registry.lastScan.source_ids, ['pinokio'], 'scan source set is recorded for later estimates')
-  })
-
-  test('scans NEVER convert: every byte-identical copy is pending, even in HF caches', async () => {
-    const { home, vault } = await makeEnv()
-    const content = crypto.randomBytes(4096)
-    const hash = sha256(content)
-    const a = await writeFile(path.resolve(home, 'api', 'appA', 'm.bin'), content)
-    const b = await writeFile(path.resolve(home, 'api', 'appB', 'm.bin'), content)
-    const hfBlob = await writeFile(
-      path.resolve(home, 'api', 'appC', 'cache', 'HF_HOME', 'hub', 'models--org--m', 'blobs', hash), content)
-    await vault.sweeper.scan()
-
-    const nlinks = [a, b, hfBlob].map((p) => fs.statSync(p).nlink)
-    assert.strictEqual(nlinks.filter((n) => n === 2).length, 1, 'exactly one copy adopted')
-    assert.strictEqual(vault.registry.duplicates.size, 2, 'other two are pending, not converted')
-    const events = await vault.registry.readEvents()
-    assert.strictEqual(events.filter((e) => e.kind === 'convert').length, 0, 'no conversion without a click')
-    assert.ok(events.some((e) => e.kind === 'found'))
-
-    const summary = await vault.sweeper.convertPending(undefined)
-    assert.strictEqual(summary.converted, 2)
-    assert.strictEqual((await fs.promises.stat(a)).ino, (await fs.promises.stat(b)).ino)
-  })
-
-  test('no name heuristics: files inside venv-like folders are found', async () => {
-    const { home, vault } = await makeEnv()
-    const content = crypto.randomBytes(4096)
-    const inVenv = await writeFile(
-      path.resolve(home, 'api', 'appA', 'coreml_venv', 'lib', 'site-packages', 'lib.dylib'), content)
-    await vault.sweeper.scan()
-    assert.strictEqual((await fs.promises.stat(inVenv)).nlink, 2, 'adopted despite venv-ish path')
-  })
-
-  test('symlinked dirs and files are skipped; cycles cannot hang the walk', async () => {
-    const { home, vault } = await makeEnv()
-    const real = await writeFile(path.resolve(home, 'api', 'appA', 'models', 'real.bin'), crypto.randomBytes(4096))
-    await fs.promises.symlink(path.resolve(home, 'api', 'appA'), path.resolve(home, 'api', 'appA', 'loop'))
-    await vault.sweeper.scan()
-    assert.strictEqual((await fs.promises.stat(real)).nlink, 2)
-  })
-
-  test('top-level linked imports are scanned as external sources while nested links stay skipped', async (t) => {
-    const { home, vault } = await makeEnv()
-    const external = await fs.promises.mkdtemp(path.resolve(os.tmpdir(), 'pinokio-external-'))
-    const nested = await fs.promises.mkdtemp(path.resolve(os.tmpdir(), 'pinokio-external-nested-'))
-    homes.push(external, nested)
-    const content = crypto.randomBytes(4096)
-    const local = await writeFile(path.resolve(home, 'api', 'appA', 'm.bin'), content)
-    const imported = await writeFile(path.resolve(external, 'models', 'm.bin'), content)
-    const nestedFile = await writeFile(path.resolve(nested, 'should-not-scan.bin'), crypto.randomBytes(4096))
-    try {
-      await fs.promises.symlink(external, path.resolve(home, 'api', 'linked-models'), process.platform === 'win32' ? 'junction' : 'dir')
-      await fs.promises.symlink(nested, path.resolve(external, 'nested-link'), process.platform === 'win32' ? 'junction' : 'dir')
-    } catch (error) {
-      t.skip(`directory links unavailable: ${error.message}`)
-      return
-    }
-
-    await vault.sweeper.scan()
-    const source = vault.sources().find((item) => item.kind === 'external' && item.label === 'linked-models')
-    const canonicalImported = path.resolve(await fs.promises.realpath(external), 'models', 'm.bin')
-    const canonicalNestedFile = path.resolve(await fs.promises.realpath(nested), 'should-not-scan.bin')
-    assert.ok(source, 'linked import becomes an external source')
-    assert.strictEqual(source.parent_id, 'external')
-    assert.ok(vault.registry.scanIndex.has(canonicalImported), 'external root was scanned')
-    assert.strictEqual(vault.registry.scanIndex.has(canonicalNestedFile), false, 'nested directory link was not followed')
-    assert.strictEqual(vault.registry.duplicates.get(canonicalImported).source_id, source.id)
-    assert.strictEqual((await fs.promises.stat(local)).nlink, 2)
-
-    const status = await vault.status()
-    assert.ok(status.sources.some((item) => item.id === source.id && item.kind === 'external'))
-    assert.strictEqual(status.duplicates.find((item) => item.path === canonicalImported).source_id, source.id)
-    assert.strictEqual(status.last_scan.home_bytes_total, content.length, 'Pinokio metric excludes external files')
-    assert.strictEqual(status.last_scan.source_bytes[source.id], content.length, 'external totals remain attributable')
-  })
-
-  test('adding an external source creates one persistent import without starting a scan', async () => {
-    const { home, vault } = await makeEnv()
-    const external = await fs.promises.mkdtemp(path.resolve(os.tmpdir(), 'pinokio-added-external-'))
-    homes.push(external)
-    const content = crypto.randomBytes(4096)
-    const imported = await writeFile(path.resolve(external, 'models', 'added.bin'), content)
-
-    const added = await vault.addExternalSource(external)
-    assert.strictEqual(added.created, true)
-    assert.strictEqual(added.source.kind, 'external')
-    assert.strictEqual(added.source.parent_id, 'external')
-    assert.strictEqual(vault.registry.scanIndex.size, 0, 'adding a source never scans it')
-    assert.strictEqual((await fs.promises.lstat(added.source.mount_path)).isSymbolicLink(), true)
-
-    const repeated = await vault.addExternalSource(external)
-    assert.strictEqual(repeated.created, false, 'the same physical folder is not imported twice')
-    assert.strictEqual(vault.sources().filter((source) => source.kind === 'external').length, 1)
-
-    await vault.sweeper.scan()
-    assert.ok(vault.registry.scanIndex.has(path.resolve(await fs.promises.realpath(imported))))
-  })
-
-  test('excluded paths are respected: no adoption, no pending, no re-listing', async () => {
-    const { home, vault } = await makeEnv()
-    const content = crypto.randomBytes(4096)
-    const a = await writeFile(path.resolve(home, 'api', 'appA', 'm.bin'), content)
-    const b = await writeFile(path.resolve(home, 'api', 'appB', 'm.bin'), content)
-    vault.registry.excluded.set(b, { ts: Date.now() })
-    await vault.sweeper.scan()
-    assert.strictEqual((await fs.promises.stat(a)).nlink, 2)
-    assert.strictEqual((await fs.promises.stat(b)).nlink, 1)
-    assert.strictEqual(vault.registry.duplicates.has(b), false)
-  })
-
-  test('steady-state rescan performs zero content hashes', async () => {
-    const { home, vault } = await makeEnv()
-    await writeFile(path.resolve(home, 'api', 'appA', 'm.bin'), crypto.randomBytes(4096))
-    await vault.sweeper.scan()
-    const after = vault.sweeper.stats.hashes
-    const priorFiles = vault.registry.lastScan.files
-    await vault.sweeper.scan()
-    assert.strictEqual(vault.sweeper.stats.hashes, after)
-    assert.strictEqual(vault.sweeper.state.estimated_files, priorFiles, 'same-source rescan uses the prior exact file count')
-  })
-
-  test('file metadata inspection uses bounded concurrency without changing results', async () => {
-    const { home, vault } = await makeEnv()
-    const dir = path.resolve(home, 'api', 'bulk')
-    await Promise.all(Array.from({ length: 48 }, (_, index) =>
-      writeFile(path.resolve(dir, `dir-${index}`, 'small.txt'), 'x')))
-    const realStat = fs.promises.stat
-    let active = 0
-    let maximum = 0
-    fs.promises.stat = async (target) => {
-      if (String(target).startsWith(dir + path.sep)) {
-        active += 1
-        maximum = Math.max(maximum, active)
-        await new Promise((resolve) => setTimeout(resolve, 3))
-        try {
-          return await realStat(target)
-        } finally {
-          active -= 1
-        }
-      }
-      return realStat(target)
-    }
-    try {
-      await vault.sweeper.scan()
-    } finally {
-      fs.promises.stat = realStat
-    }
-    assert.ok(maximum > 1, `expected concurrent metadata reads, saw ${maximum}`)
-    assert.ok(maximum <= vault.statConcurrency, `metadata concurrency exceeded its bound: ${maximum}`)
-    assert.strictEqual(vault.registry.lastScan.files >= 48, true)
-  })
-
-  test('multiple names for one inode share one exact hash job', async () => {
-    const { home, vault } = await makeEnv()
-    const content = crypto.randomBytes(4096)
-    const a = await writeFile(path.resolve(home, 'api', 'appA', 'model.bin'), content)
-    const b = path.resolve(home, 'api', 'appB', 'model.bin')
-    await fs.promises.mkdir(path.dirname(b), { recursive: true })
-    await fs.promises.link(a, b)
-
-    await vault.sweeper.scan()
-
-    assert.strictEqual(vault.registry.lastScan.hashed, 1, 'physical content was hashed once')
-    assert.strictEqual(vault.registry.lastScan.inode_reuses, 1, 'second name reused the inode hash job')
-    assert.strictEqual(vault.registry.duplicates.size, 0, 'existing hard links are already shared')
-    assert.strictEqual(vault.registry.links.get(a).hash, sha256(content))
-    assert.strictEqual(vault.registry.links.get(b).hash, sha256(content))
-  })
-
-  test('a file changed during hashing never publishes the stale digest', async () => {
-    const { home, vault } = await makeEnv()
-    const original = crypto.randomBytes(4096)
-    const oldHash = sha256(original)
-    const file = await writeFile(path.resolve(home, 'api', 'appA', 'changing.bin'), original)
-    const realHashFile = vault.hashFile.bind(vault)
-    vault.hashFile = async (target) => {
-      const result = await realHashFile(target)
-      await fs.promises.writeFile(target, crypto.randomBytes(original.length))
-      const future = new Date(Date.now() + 2000)
-      await fs.promises.utimes(target, future, future)
-      return result
-    }
-
-    try {
-      await vault.sweeper.scan()
-    } finally {
-      vault.hashFile = realHashFile
-    }
-
-    assert.strictEqual(vault.registry.lastScan.unstable_hashes, 1)
-    assert.strictEqual(vault.registry.blobs.has(oldHash), false, 'stale digest was discarded')
-    assert.strictEqual(vault.registry.scanIndex.has(file), false, 'unstable path remains unclassified')
-    assert.strictEqual((await fs.promises.stat(file)).nlink, 1, 'unstable file was not adopted')
-  })
-
-  test('conversion tmp files are never candidates', async () => {
-    const { home, vault } = await makeEnv()
-    const stray = await writeFile(path.resolve(home, 'api', 'appA', 'm.bin.pinokio-dedup-tmp'), crypto.randomBytes(4096))
-    await vault.sweeper.scan()
-    assert.strictEqual(vault.registry.scanIndex.has(stray), false)
-    assert.strictEqual((await fs.promises.stat(stray)).nlink, 1)
-  })
-
-  test('hf --local-dir metadata provides hashes without content reads', async () => {
-    const { home, vault } = await makeEnv()
-    const content = crypto.randomBytes(4096)
-    const hash = sha256(content)
-    const dir = path.resolve(home, 'api', 'appA', 'ckpt')
-    const file = await writeFile(path.resolve(dir, 'model.safetensors'), content)
-    const future = (Date.now() + 60000) / 1000
-    await writeFile(
-      path.resolve(dir, '.cache', 'huggingface', 'model.safetensors.metadata'),
-      `commit123\n"${hash}"\n${future}\n`)
-    await vault.sweeper.scan()
-    assert.strictEqual(vault.sweeper.stats.hashes, 0, 'hash harvested, not computed')
-    assert.strictEqual((await fs.promises.stat(file)).nlink, 2)
-    assert.ok(vault.registry.blobs.has(hash))
-  })
-
-  test('in-place mutation propagates to all names; scan detects divergence and evicts', async () => {
-    const { home, vault } = await makeEnv()
-    const original = crypto.randomBytes(4096)
-    const oldHash = sha256(original)
-    const a = await writeFile(path.resolve(home, 'api', 'appA', 'm.bin'), original)
-    await vault.adopt(a, oldHash, { app: 'appA' })
-    const b = path.resolve(home, 'api', 'appB', 'm.bin')
-    await writeFile(b, original)
-    await vault.convert(b, oldHash, { app: 'appB' })
-    await vault.sweeper.scan()
-
-    const mutated = crypto.randomBytes(4096)
-    await fs.promises.writeFile(b, mutated)
-    assert.deepStrictEqual(await fs.promises.readFile(a), mutated, 'in-place writes propagate to every name')
-
-    await vault.sweeper.scan()
-    assert.strictEqual(vault.registry.blobs.has(oldHash), false, 'stale blob evicted')
-    assert.strictEqual(fs.existsSync(vault.storePathFor(oldHash)), false)
-    assert.ok(vault.registry.blobs.has(sha256(mutated)))
-    const events = await vault.registry.readEvents()
-    assert.ok(events.some((e) => e.kind === 'diverged' && e.hash === oldHash))
-  })
-
-  test('scan of a 10k-entry folder at steady state finishes fast with zero reads', async () => {
-    const { home, vault } = await makeEnv()
-    const dir = path.resolve(home, 'api', 'bigapp', 'stuff')
-    await fs.promises.mkdir(dir, { recursive: true })
-    const tiny = Buffer.from('x')
-    await Promise.all(Array.from({ length: 10000 }, (_, i) =>
-      fs.promises.writeFile(path.resolve(dir, `f${i}.txt`), tiny)))
-    await vault.sweeper.scan()
-    const started = Date.now()
-    await vault.sweeper.scan()
-    const elapsed = Date.now() - started
-    assert.ok(elapsed < 2000, `steady-state rescan took ${elapsed}ms`)
-    assert.strictEqual(vault.sweeper.stats.hashes, 0)
-  })
-
-  test('locked conversions stay pending and can be retried', async () => {
-    const { home, vault } = await makeEnv()
-    const content = crypto.randomBytes(4096)
-    const hash = sha256(content)
-    const a = await writeFile(path.resolve(home, 'api', 'appA', 'm.bin'), content)
-    await vault.adopt(a, hash, { app: 'appA' })
-    const b = await writeFile(path.resolve(home, 'api', 'appB', 'm.bin'), content)
-    vault.registry.duplicates.set(b, { hash, size: content.length, app: 'appB' })
-
-    const realConvert = vault.convert.bind(vault)
-    let calls = 0
-    vault.convert = async (...args) => {
-      calls += 1
-      if (calls === 1) return { status: 'locked' }
-      return realConvert(...args)
-    }
-    const first = await vault.sweeper.convertPending('appB')
-    assert.strictEqual(first.locked, 1)
-    assert.ok(vault.registry.duplicates.has(b), 'still pending after lock')
-    const second = await vault.sweeper.convertPending('appB')
-    vault.convert = realConvert
-    assert.strictEqual(second.converted, 1)
-    assert.strictEqual((await fs.promises.stat(b)).ino, (await fs.promises.stat(a)).ino)
-  })
-})

package/test/vault-ui.test.js

@@ -1,324 +0,0 @@
-const { test, describe, after } = require('node:test')
-const assert = require('node:assert')
-const fs = require('fs')
-const os = require('os')
-const path = require('path')
-const crypto = require('crypto')
-const Vault = require('../kernel/vault')
-
-const sha256 = (buf) => crypto.createHash('sha256').update(buf).digest('hex')
-
-const writeFile = async (p, content) => {
-  await fs.promises.mkdir(path.dirname(p), { recursive: true })
-  await fs.promises.writeFile(p, content)
-  return p
-}
-
-describe('vault dashboard backend (phase 4)', () => {
-  let homes = []
-  const makeEnv = async () => {
-    const home = await fs.promises.mkdtemp(path.resolve(os.tmpdir(), 'pinokio-ui-'))
-    homes.push(home)
-    await fs.promises.mkdir(path.resolve(home, 'api'), { recursive: true })
-    const kernel = { homedir: home, platform: process.platform, path: (...a) => path.resolve(home, ...a) }
-    const vault = new Vault(kernel)
-    await vault.init()
-    vault.sizeThreshold = 1024
-    return { home, vault }
-  }
-  after(async () => {
-    for (const h of homes) await fs.promises.rm(h, { recursive: true, force: true }).catch(() => {})
-  })
-
-  const makeSharedPair = async (home, vault, name = 'm.bin') => {
-    const content = crypto.randomBytes(4096)
-    const hash = sha256(content)
-    const a = await writeFile(path.resolve(home, 'api', 'appA', name), content)
-    await vault.adopt(a, hash, { app: 'appA' })
-    const b = await writeFile(path.resolve(home, 'api', 'appB', name), content)
-    const conv = await vault.convert(b, hash, { app: 'appB', batch_id: `batch-${name}` })
-    assert.strictEqual(conv.status, 'converted')
-    return { content, hash, a, b }
-  }
-
-  test('item 15: undo of a conversion batch restores independent files', async () => {
-    const { home, vault } = await makeEnv()
-    const { content, a, b } = await makeSharedPair(home, vault)
-    const savedBefore = vault.registry.totals.lifetime_bytes_saved
-
-    const result = await vault.undoBatch('batch-m.bin')
-    assert.strictEqual(result.undone, 1)
-    assert.strictEqual((await fs.promises.stat(b)).nlink, 1, 'independent file again')
-    assert.deepStrictEqual(await fs.promises.readFile(b), content)
-    assert.strictEqual((await fs.promises.stat(a)).nlink, 2, 'other names untouched')
-    assert.strictEqual(vault.registry.totals.lifetime_bytes_saved, savedBefore - content.length)
-    assert.ok(vault.registry.duplicates.has(b), 'undone file is pending again')
-    const events = await vault.registry.readEvents()
-    assert.ok(events.some((e) => e.kind === 'undo' && e.batch_id === 'batch-m.bin'))
-  })
-
-  test('detach makes one name independent and pins it against future scans', async () => {
-    const { home, vault } = await makeEnv()
-    const { content, a, b } = await makeSharedPair(home, vault)
-
-    const result = await vault.detach(b)
-    assert.strictEqual(result.status, 'detached')
-    assert.strictEqual((await fs.promises.stat(b)).nlink, 1)
-    assert.deepStrictEqual(await fs.promises.readFile(b), content)
-    assert.strictEqual((await fs.promises.stat(a)).nlink, 2)
-    assert.ok(vault.registry.excluded.has(b))
-    assert.strictEqual(vault.registry.excluded.get(b).size, content.length)
-    assert.strictEqual(fs.existsSync(b + '.pinokio-dedup-tmp'), false)
-
-    // A scan neither re-adopts nor re-lists the pinned path.
-    await vault.sweeper.scan()
-    assert.strictEqual((await fs.promises.stat(b)).nlink, 1)
-    assert.strictEqual(vault.registry.duplicates.has(b), false)
-
-    // Re-share un-pins; the next scan lists it as pending again (no auto-convert).
-    const reshared = await vault.reshare(b)
-    assert.strictEqual(reshared.status, 'resharable')
-    await vault.sweeper.scan()
-    assert.ok(vault.registry.duplicates.has(b))
-    assert.strictEqual((await fs.promises.stat(b)).nlink, 1)
-  })
-
-  test('detach on a pending duplicate just ignores it', async () => {
-    const { home, vault } = await makeEnv()
-    const content = crypto.randomBytes(4096)
-    const hash = sha256(content)
-    const a = await writeFile(path.resolve(home, 'api', 'appA', 'm.bin'), content)
-    await vault.adopt(a, hash, { app: 'appA' })
-    const b = await writeFile(path.resolve(home, 'api', 'appB', 'm.bin'), content)
-    vault.registry.duplicates.set(b, { hash, size: content.length, app: 'appB' })
-
-    const result = await vault.detach(b)
-    assert.strictEqual(result.status, 'ignored')
-    assert.strictEqual(vault.registry.duplicates.has(b), false)
-    assert.ok(vault.registry.excluded.has(b))
-    assert.strictEqual(vault.registry.excluded.get(b).size, content.length)
-  })
-
-  test('status(): disk figures, scan metadata, excluded list', async () => {
-    const { home, vault } = await makeEnv()
-    const { content, hash } = await makeSharedPair(home, vault)
-    await vault.detach(path.resolve(home, 'api', 'appB', 'm.bin'))
-    await vault.sweeper.scan()
-    const status = await vault.status()
-    assert.strictEqual(status.enabled, true)
-    assert.strictEqual(status.bytes_on_disk, content.length)
-    assert.ok(status.last_scan && status.last_scan.files > 0)
-    assert.strictEqual(status.excluded.length, 1)
-    assert.strictEqual(status.excluded[0].size, content.length)
-    assert.strictEqual(status.blobs.length, 1)
-    assert.deepStrictEqual(status.blobs[0].apps, ['appA'])
-    assert.ok(status.scan && status.scan.active === false)
-  })
-
-  test('reclaimAll frees every orphan and nothing else', async () => {
-    const { home, vault } = await makeEnv()
-    const keep = crypto.randomBytes(4096)
-    const drop = crypto.randomBytes(4096)
-    const keptFile = await writeFile(path.resolve(home, 'api', 'appA', 'keep.bin'), keep)
-    const droppedFile = await writeFile(path.resolve(home, 'api', 'appA', 'drop.bin'), drop)
-    await vault.adopt(keptFile, sha256(keep), { app: 'appA' })
-    await vault.adopt(droppedFile, sha256(drop), { app: 'appA' })
-    await fs.promises.unlink(droppedFile)
-    await vault.verify()
-    const result = await vault.reclaimAll()
-    assert.strictEqual(result.reclaimed, 1)
-    assert.strictEqual(result.bytes_freed, drop.length)
-    assert.ok(vault.registry.blobs.has(sha256(keep)))
-    assert.strictEqual(vault.registry.blobs.has(sha256(drop)), false)
-  })
-
-  test('item 16: vocabulary lint — vault page copy avoids forbidden terms', async () => {
-    const forbidden = /hard.?link|junction|symlink|inode|\bblob\b|\bstore\b|\bdedupe\b/i
-    const vaultPage = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'views', 'vault.ejs'), 'utf8')
-    const copyBlock = vaultPage.match(/const COPY = \{[\s\S]*?\n\}/)
-    assert.ok(copyBlock, 'vault.ejs must keep user copy in a COPY object')
-    for (const m of copyBlock[0].matchAll(/:\s*"([^"]*)"/g)) {
-      assert.ok(!forbidden.test(m[1]), `forbidden term in vault page copy: "${m[1]}"`)
-    }
-  })
-
-  test('duplicate matches show complete filesystem paths without ellipsis', async () => {
-    const vaultPage = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'views', 'vault.ejs'), 'utf8')
-    assert.match(vaultPage, /class="vault-match-path">\$\{esc\(match\.path\)\}/)
-    const style = vaultPage.match(/\.vault-match-path \{[\s\S]*?\n\}/)
-    assert.ok(style, 'match path must have dedicated wrapping styles')
-    assert.match(style[0], /overflow-wrap:\s*anywhere/)
-    assert.match(style[0], /white-space:\s*normal/)
-    assert.doesNotMatch(style[0], /text-overflow:\s*ellipsis/)
-  })
-
-  test('copy-mode tracking never claims physical sharing savings', async () => {
-    const { home, vault } = await makeEnv()
-    const content = crypto.randomBytes(4096)
-    const hash = sha256(content)
-    const first = await writeFile(path.resolve(home, 'api', 'appA', 'm.bin'), content)
-    const second = await writeFile(path.resolve(home, 'api', 'appB', 'm.bin'), content)
-    const firstStat = await fs.promises.stat(first)
-    const secondStat = await fs.promises.stat(second)
-    vault.registry.addBlob(hash, { size: content.length })
-    vault.registry.addLink(first, { hash, app: 'appA', dev: firstStat.dev, ino: firstStat.ino, mode: 'copy' })
-    vault.registry.addLink(second, { hash, app: 'appB', dev: secondStat.dev, ino: secondStat.ino, mode: 'copy' })
-
-    const status = await vault.status()
-    assert.strictEqual(status.bytes_on_disk, content.length * 2)
-    assert.strictEqual(status.saved_by_sharing, 0)
-  })
-
-  test('repair is advanced, metrics distinguish detected and explicit savings, and refresh retries', async () => {
-    const vaultPage = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'views', 'vault.ejs'), 'utf8')
-    assert.match(vaultPage, /already_shared:\s*"Already shared"/)
-    assert.match(vaultPage, /saved_by_vault:\s*"Saved by Vault"/)
-    assert.match(vaultPage, /repair_index:\s*"Repair Vault index"/)
-    assert.match(vaultPage, /<details class='vault-advanced'/)
-    assert.doesNotMatch(vaultPage, /id='btn-rebuild'/)
-    const refreshBlock = vaultPage.match(/const refresh = async \(\) => \{[\s\S]*?\n\}/)
-    assert.ok(refreshBlock)
-    assert.match(refreshBlock[0], /finally/)
-    assert.doesNotMatch(vaultPage, /priorScanning/)
-  })
-
-  test('vault uses compact desktop density without truncating duplicate matches', async () => {
-    const vaultPage = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'views', 'vault.ejs'), 'utf8')
-    assert.match(vaultPage, /--vault-control-height:\s*28px/)
-    assert.match(vaultPage, /--vault-row-height:\s*44px/)
-    assert.match(vaultPage, /--vault-tree-row:\s*26px/)
-    assert.match(vaultPage, /--vault-tree-path-row:\s*34px/)
-    assert.match(vaultPage, /\.vault-shell \*,?[\s\S]*?box-sizing:\s*border-box/)
-    assert.match(vaultPage, /grid-template-columns:\s*248px minmax\(0, 1fr\)/)
-    assert.match(vaultPage, /\.vault-toolbar \{[\s\S]*?min-height:\s*44px/)
-    assert.match(vaultPage, /\.vault-match-path \{[\s\S]*?overflow-wrap:\s*anywhere/)
-    assert.doesNotMatch(vaultPage, /<header class='task-shell-header'>/)
-    assert.doesNotMatch(vaultPage, /id='vault-(?:title|subtitle)'/)
-    assert.match(vaultPage, /\.vault-overview \{[\s\S]*?padding:\s*7px var\(--vault-inline\)/)
-    assert.match(vaultPage, /\.vault-metric \{[\s\S]*?border:\s*0;[\s\S]*?border-left:\s*1px solid var\(--task-border\)/)
-    assert.match(vaultPage, /button\.vault-metric \{[\s\S]*?font:\s*inherit/)
-    assert.match(vaultPage, /id='btn-add-source'/)
-    assert.match(vaultPage, /<script src="\/Socket\.js"><\/script>/)
-    assert.match(vaultPage, /action:\s*"add_source"/)
-    assert.match(vaultPage, /identical_contents_at:\s*"Identical contents at"/)
-    assert.doesNotMatch(vaultPage, /Matching locations/)
-    assert.match(vaultPage, /scan_waiting:\s*"Waiting for scan results"/)
-    assert.match(vaultPage, /view === "all" && !scanning \? `<button class="vault-button" type="button" id="btn-empty-scan"/)
-    assert.match(vaultPage, /class="vault-progress-track"/)
-    assert.match(vaultPage, /role="progressbar"/)
-    assert.match(vaultPage, /scan\.walk_duration_ms == null/)
-    assert.match(vaultPage, /const hashTotal = scan\.hash_total/)
-    assert.match(vaultPage, /const hasEstimate = Number\.isFinite\(scan\.estimated_files\)/)
-    assert.match(vaultPage, /scan_estimate_help:\s*"Estimated from your last completed scan"/)
-    assert.match(vaultPage, /\$\{estimated \? "~" : ""\}\$\{progressValue\}%/)
-    assert.match(vaultPage, /\.vault-progress-bar\.determinate \{[\s\S]*?transform:\s*scaleX/)
-    assert.match(vaultPage, /\.vault-progress-bar\.indeterminate \{[\s\S]*?transform:\s*scaleX\(1\)[\s\S]*?animation:\s*vault-progress-pulse/)
-    assert.doesNotMatch(vaultPage, /vault-progress-sweep/)
-    assert.match(vaultPage, /body\.vault-page \.task-container \{[\s\S]*?overflow:\s*hidden/)
-    assert.match(vaultPage, /\.vault-explorer \{[\s\S]*?flex:\s*1 1 auto[\s\S]*?overflow:\s*hidden/)
-    assert.match(vaultPage, /\.vault-rail \{[\s\S]*?overflow-y:\s*auto[\s\S]*?overscroll-behavior:\s*contain/)
-    assert.match(vaultPage, /\.vault-pane \{[\s\S]*?grid-template-rows:\s*auto minmax\(0, 1fr\) auto/)
-    assert.doesNotMatch(vaultPage, /vault-pane-head/)
-    assert.match(vaultPage, /const toolbarSummary = \(visibleItems\) =>/)
-    assert.match(vaultPage, /id="vault-toolbar-summary"/)
-    assert.match(vaultPage, /\.vault-table-wrap \{[\s\S]*?overflow:\s*auto[\s\S]*?overscroll-behavior:\s*contain/)
-    assert.match(vaultPage, /#vault-locations \{[\s\S]*?flex-direction:\s*column[\s\S]*?justify-content:\s*flex-start[\s\S]*?gap:\s*0/)
-    assert.match(vaultPage, /\.vault-source-line\.depth-2 \{ padding-left:\s*24px; \}/)
-    assert.match(vaultPage, /vault-source-line depth-\$\{Math\.min\(depth, 2\)\} \$\{pathText \? "has-path" : ""\}/)
-  })
-
-  test('vault route provisions the dev requirements needed by its folder picker', async () => {
-    const serverSource = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'index.js'), 'utf8')
-    const routeStart = serverSource.indexOf('this.app.get("/vault"')
-    const routeEnd = serverSource.indexOf('this.app.post("/vault/action"', routeStart)
-    assert.ok(routeStart >= 0 && routeEnd > routeStart, 'vault route must be present')
-    const route = serverSource.slice(routeStart, routeEnd)
-    assert.match(route, /this\.kernel\.bin\.check\(/)
-    assert.match(route, /this\.kernel\.bin\.preset\("dev"\)/)
-    assert.match(route, /requirements_pending \|\| install_required/)
-    assert.match(route, /\/setup\/dev\?callback=\$\{encodeURIComponent\(req\.originalUrl\)\}/)
-    assert.ok(route.indexOf('res.redirect') < route.indexOf('res.render("vault"'), 'requirements redirect must happen before rendering Vault')
-  })
-
-  test('deduplicate batches share a batch id and are undoable as one', async () => {
-    const { home, vault } = await makeEnv()
-    const c1 = crypto.randomBytes(4096)
-    const c2 = crypto.randomBytes(4096)
-    const a1 = await writeFile(path.resolve(home, 'api', 'appA', 'm1.bin'), c1)
-    const a2 = await writeFile(path.resolve(home, 'api', 'appA', 'm2.bin'), c2)
-    await vault.adopt(a1, sha256(c1), { app: 'appA' })
-    await vault.adopt(a2, sha256(c2), { app: 'appA' })
-    const b1 = await writeFile(path.resolve(home, 'api', 'appB', 'm1.bin'), c1)
-    const b2 = await writeFile(path.resolve(home, 'api', 'appB', 'm2.bin'), c2)
-    vault.registry.duplicates.set(b1, { hash: sha256(c1), size: c1.length, app: 'appB' })
-    vault.registry.duplicates.set(b2, { hash: sha256(c2), size: c2.length, app: 'appB' })
-
-    const summary = await vault.sweeper.convertPending('appB', { batch_id: 'batch-x' })
-    assert.strictEqual(summary.converted, 2)
-    assert.strictEqual(summary.bytes_saved, c1.length + c2.length)
-
-    const undo = await vault.undoBatch('batch-x')
-    assert.strictEqual(undo.undone, 2)
-    assert.strictEqual((await fs.promises.stat(b1)).nlink, 1)
-    assert.strictEqual((await fs.promises.stat(b2)).nlink, 1)
-  })
-
-  test('source-scoped batches never include another non-app location', async () => {
-    const { home, vault } = await makeEnv()
-    const content = crypto.randomBytes(4096)
-    const hash = sha256(content)
-    const original = await writeFile(path.resolve(home, 'api', 'appA', 'm.bin'), content)
-    const appCopy = await writeFile(path.resolve(home, 'api', 'appB', 'm.bin'), content)
-    const cacheCopy = await writeFile(path.resolve(home, 'cache', 'models', 'm.bin'), content)
-    await vault.refreshSources()
-    const appA = vault.sources().find((item) => item.kind === 'app' && item.app === 'appA')
-    const appB = vault.sources().find((item) => item.kind === 'app' && item.app === 'appB')
-    const cache = vault.sources().find((item) => item.kind === 'folder' && item.label === 'cache')
-    await vault.adopt(original, hash, { app: 'appA', source_id: appA.id })
-    vault.registry.duplicates.set(appCopy, { hash, size: content.length, app: 'appB', source_id: appB.id })
-    vault.registry.duplicates.set(cacheCopy, { hash, size: content.length, app: null, source_id: cache.id })
-
-    const result = await vault.sweeper.convertPending(undefined, { scope_id: appB.id, batch_id: 'scope-app-b' })
-    assert.strictEqual(result.converted, 1)
-    assert.strictEqual((await fs.promises.stat(appCopy)).ino, (await fs.promises.stat(original)).ino)
-    assert.strictEqual((await fs.promises.stat(cacheCopy)).nlink, 1)
-    assert.ok(vault.registry.duplicates.has(cacheCopy), 'other non-app scope remains pending')
-  })
-
-  test('unavailable conversions remain pending for review', async () => {
-    const { home, vault } = await makeEnv()
-    const content = crypto.randomBytes(4096)
-    const hash = sha256(content)
-    const original = await writeFile(path.resolve(home, 'api', 'appA', 'm.bin'), content)
-    const pending = await writeFile(path.resolve(home, 'api', 'appB', 'm.bin'), content)
-    await vault.adopt(original, hash, { app: 'appA' })
-    vault.registry.duplicates.set(pending, { hash, size: content.length, app: 'appB' })
-    const realConvert = vault.convert.bind(vault)
-    vault.convert = async () => ({ status: 'unavailable' })
-    const result = await vault.sweeper.convertPending('appB')
-    vault.convert = realConvert
-    assert.strictEqual(result.unavailable, 1)
-    assert.ok(vault.registry.duplicates.has(pending))
-    assert.strictEqual(vault.registry.links.has(pending), false)
-  })
-
-  test('status separates app, Pinokio folder, and external source metadata', async (t) => {
-    const { home, vault } = await makeEnv()
-    const external = await fs.promises.mkdtemp(path.resolve(os.tmpdir(), 'pinokio-ui-external-'))
-    homes.push(external)
-    try {
-      await fs.promises.symlink(external, path.resolve(home, 'api', 'linked-models'), process.platform === 'win32' ? 'junction' : 'dir')
-    } catch (error) {
-      t.skip(`directory links unavailable: ${error.message}`)
-      return
-    }
-    await fs.promises.mkdir(path.resolve(home, 'api', 'local-app'), { recursive: true })
-    await fs.promises.mkdir(path.resolve(home, 'cache'), { recursive: true })
-    await vault.refreshSources()
-    const status = await vault.status()
-    const byKind = new Map(status.sources.map((source) => [source.id, source]))
-    assert.ok([...byKind.values()].some((source) => source.kind === 'app' && source.label === 'local-app' && source.parent_id === 'apps'))
-    assert.ok([...byKind.values()].some((source) => source.kind === 'folder' && source.label === 'cache' && source.parent_id === 'pinokio'))
-    assert.ok([...byKind.values()].some((source) => source.kind === 'external' && source.label === 'linked-models' && source.parent_id === 'external'))
-  })
-})