pinokiod 7.2.4 → 7.2.6

package/kernel/bin/ffmpeg.js

@@ -1,13 +1,16 @@
+const crypto = require("crypto")
 const fs = require("fs")
 const path = require("path")
 const { execFile } = require("child_process")
 const ParcelWatcher = require("@parcel/watcher")
 const semver = require("semver")
 const { rimraf } = require("rimraf")
+const Util = require("../util")
 
 const RELEASE_VERSION = "8.0.1"
 const RELEASE_RANGE = ">=8.0.1 <8.1.0"
 const CONDA_SPEC = `ffmpeg=${RELEASE_VERSION}`
+const CONDA_CHANNEL_FLAGS = "--override-channels -c conda-forge"
 
 const WINDOWS_GDK_PIXBUF_POST_LINK_NOOP = `@echo off
 rem Pinokio intentionally skips gdk-pixbuf loader cache generation for FFmpeg installs.
@@ -27,25 +30,36 @@ class Ffmpeg {
       FFMPEG_PATH: this.binaryPath("ffmpeg", activeKernel),
       FFPROBE_PATH: this.binaryPath("ffprobe", activeKernel)
     }
+    if (activeKernel.platform === "win32") {
+      env.PATH = [this.libraryDir(activeKernel)]
+    }
     if (activeKernel.platform === "linux") {
       env.LD_LIBRARY_PATH = [this.libraryDir(activeKernel)]
     }
     return env
   }
 
+  ffmpegPrefix(kernel = this.kernel) {
+    return kernel.bin.path("ffmpeg-env")
+  }
+
+  ffmpegPkgsDir(kernel = this.kernel) {
+    return kernel.bin.path("ffmpeg-pkgs")
+  }
+
   binaryPath(tool, kernel = this.kernel) {
     const filename = kernel.platform === "win32" ? `${tool}.exe` : tool
     if (kernel.platform === "win32") {
-      return kernel.bin.path("miniconda", "Library", "bin", filename)
+      return path.resolve(this.ffmpegPrefix(kernel), "Library", "bin", filename)
     }
-    return kernel.bin.path("miniconda", "bin", filename)
+    return path.resolve(this.ffmpegPrefix(kernel), "bin", filename)
   }
 
   libraryDir(kernel = this.kernel) {
     if (kernel.platform === "win32") {
-      return kernel.bin.path("miniconda", "Library", "bin")
+      return path.resolve(this.ffmpegPrefix(kernel), "Library", "bin")
     }
-    return kernel.bin.path("miniconda", "lib")
+    return path.resolve(this.ffmpegPrefix(kernel), "lib")
   }
 
   legacyStandalonePaths() {
@@ -59,11 +73,19 @@ class Ffmpeg {
     if (this.kernel.platform !== "darwin") {
       return
     }
-    if (!this.isInstalledVersion()) {
-      return
+    try {
+      if (!(await this.hasInstalledBinaryPaths())) {
+        await this.removeRuntimeExposure()
+        return
+      }
+      await this.selfTest()
+      await this.ensureBaseActivationHooks()
+      await this.syncMacUvLibraryShims()
+      await this.startMacUvLibraryWatcher()
+    } catch (error) {
+      await this.removeRuntimeExposure()
+      console.log("conda ffmpeg start check failed", error && error.message ? error.message : error)
     }
-    await this.syncMacUvLibraryShims()
-    await this.startMacUvLibraryWatcher()
   }
 
   async install(req, ondata) {
@@ -73,36 +95,53 @@ class Ffmpeg {
     } else {
       await this.installStandard(ondata)
     }
-    await this.syncMacUvLibraryShims(ondata)
     await this.selfTest(ondata)
+    await this.ensureBaseActivationHooks()
+    await this.syncMacUvLibraryShims(ondata)
   }
 
   async installStandard(ondata) {
+    await this.resetInstallPrefix()
     await this.kernel.bin.exec({
+      env: {
+        CONDA_PKGS_DIRS: this.ffmpegPkgsDir()
+      },
       message: [
         "conda clean -y --all",
-        `conda install -y -c conda-forge ${this.cmd()}`
+        `conda create -y -p "${this.ffmpegPrefix()}" ${CONDA_CHANNEL_FLAGS} ${this.cmd()}`
       ]
     }, ondata)
   }
 
   async installWindows(ondata) {
+    await this.resetInstallPrefix()
+    const env = {
+      CONDA_PKGS_DIRS: this.ffmpegPkgsDir()
+    }
+
     await this.kernel.bin.exec({
+      env,
       message: [
         "conda clean -y --all",
-        `conda install -y --download-only -c conda-forge ${this.cmd()}`
+        `conda create -y --download-only -p "${this.ffmpegPrefix()}" ${CONDA_CHANNEL_FLAGS} ${this.cmd()}`
       ]
     }, ondata)
 
-    await this.patchWindowsGdkPixbufPostLink(ondata)
+    await this.patchWindowsGdkPixbufPostLink(this.ffmpegPkgsDir(), ondata)
 
     await this.kernel.bin.exec({
-      message: `conda install -y --offline -c conda-forge ${this.cmd()}`
+      env,
+      message: `conda create -y --offline -p "${this.ffmpegPrefix()}" ${CONDA_CHANNEL_FLAGS} ${this.cmd()}`
     }, ondata)
   }
 
-  async patchWindowsGdkPixbufPostLink(ondata) {
-    const pkgsDir = this.kernel.bin.path("miniconda", "pkgs")
+  async resetInstallPrefix() {
+    await rimraf(this.ffmpegPrefix())
+    await rimraf(this.ffmpegPkgsDir())
+    await fs.promises.mkdir(this.ffmpegPkgsDir(), { recursive: true })
+  }
+
+  async patchWindowsGdkPixbufPostLink(pkgsDir, ondata) {
     const entries = await fs.promises.readdir(pkgsDir, { withFileTypes: true })
     const packageDirs = entries
       .filter((entry) => entry.isDirectory() && /^gdk-pixbuf-/.test(entry.name))
@@ -113,17 +152,31 @@ class Ffmpeg {
     }
 
     let patchedCount = 0
+    let metadataCount = 0
     for (const packageDir of packageDirs) {
       const scripts = [
-        path.resolve(packageDir, "Scripts", ".gdk-pixbuf-post-link.bat"),
-        path.resolve(packageDir, "info", "recipe", "post-link.bat")
+        {
+          relativePath: "Scripts/.gdk-pixbuf-post-link.bat",
+          metadataRequired: true
+        },
+        {
+          relativePath: "info/recipe/post-link.bat",
+          metadataRequired: false
+        }
       ]
 
-      for (const script of scripts) {
+      for (const { relativePath, metadataRequired } of scripts) {
+        const script = path.resolve(packageDir, ...relativePath.split("/"))
         try {
           await fs.promises.access(script)
           await fs.promises.writeFile(script, WINDOWS_GDK_PIXBUF_POST_LINK_NOOP)
           patchedCount += 1
+          const updatedMetadata = await this.updateCondaPathsJson(packageDir, relativePath, WINDOWS_GDK_PIXBUF_POST_LINK_NOOP)
+          if (updatedMetadata) {
+            metadataCount += 1
+          } else if (metadataRequired) {
+            throw new Error(`Patched ${relativePath} in ${packageDir}, but did not find a matching info/paths.json entry`)
+          }
         } catch (error) {
           if (error && error.code !== "ENOENT") {
             throw error
@@ -136,41 +189,329 @@ class Ffmpeg {
       throw new Error("Found gdk-pixbuf in the Conda cache, but did not find any post-link scripts to patch")
     }
 
-    ondata({ raw: `patched ${patchedCount} gdk-pixbuf post-link script(s) in the Conda cache...\r\n` })
+    if (ondata) {
+      ondata({
+        raw: `patched ${patchedCount} gdk-pixbuf post-link script(s) in the Conda cache and refreshed ${metadataCount} paths.json entr${metadataCount === 1 ? "y" : "ies"}...\r\n`
+      })
+    }
   }
 
-  async installed() {
+  async updateCondaPathsJson(packageDir, relativePath, contents) {
+    const pathsJsonPath = path.resolve(packageDir, "info", "paths.json")
+    let pathsJson
+
     try {
-      if (!this.isInstalledVersion()) {
+      pathsJson = JSON.parse(await fs.promises.readFile(pathsJsonPath, "utf8"))
+    } catch (error) {
+      if (error && error.code === "ENOENT") {
         return false
       }
+      throw error
+    }
+
+    if (!pathsJson || !Array.isArray(pathsJson.paths)) {
+      return false
+    }
+
+    const normalizedPath = relativePath.replace(/\\/g, "/")
+    const entry = pathsJson.paths.find((item) => item && item._path === normalizedPath)
+    if (!entry) {
+      return false
+    }
+
+    const buffer = Buffer.isBuffer(contents) ? contents : Buffer.from(String(contents), "utf8")
+    entry.sha256 = crypto.createHash("sha256").update(buffer).digest("hex")
+    entry.size_in_bytes = buffer.length
+
+    await fs.promises.writeFile(pathsJsonPath, `${JSON.stringify(pathsJson, null, 2)}\n`)
+    return true
+  }
 
+  async hasInstalledBinaryPaths() {
+    try {
       await fs.promises.access(this.binaryPath("ffmpeg"))
       await fs.promises.access(this.binaryPath("ffprobe"))
+      return true
+    } catch (error) {
+      return false
+    }
+  }
+
+  async removeRuntimeExposure(ondata) {
+    await this.stopMacUvLibraryWatcher()
+    await this.removeMacUvLibraryShims(ondata)
+    await this.removeBaseActivationHooks()
+  }
+
+  async installed() {
+    try {
+      if (!(await this.hasInstalledBinaryPaths())) {
+        await this.removeRuntimeExposure()
+        return false
+      }
+
+      await this.selfTest()
+      await this.ensureBaseActivationHooks()
       await this.syncMacUvLibraryShims()
       await this.startMacUvLibraryWatcher()
-      await this.selfTest()
       return true
     } catch (error) {
+      await this.removeRuntimeExposure()
       console.log("conda ffmpeg installed check failed", error && error.message ? error.message : error)
       return false
     }
   }
 
   async uninstall(req, ondata) {
-    await this.stopMacUvLibraryWatcher()
-    await this.removeMacUvLibraryShims(ondata)
-    await this.kernel.bin.exec({
-      message: "conda remove -y ffmpeg"
-    }, ondata)
+    await this.removeRuntimeExposure(ondata)
+    const prefix = this.ffmpegPrefix()
+    const exists = await fs.promises.access(prefix).then(() => true).catch(() => false)
+    if (exists) {
+      try {
+        await this.kernel.bin.exec({
+          env: {
+            CONDA_PKGS_DIRS: this.ffmpegPkgsDir()
+          },
+          message: `conda remove -y -p "${prefix}" --all`
+        }, ondata)
+      } catch (error) {
+        await rimraf(prefix)
+      }
+    }
+    await rimraf(prefix)
+    await rimraf(this.ffmpegPkgsDir())
     await this.cleanupLegacyStandalone(ondata)
   }
 
-  isInstalledVersion() {
-    if (!this.kernel.bin.installed?.conda?.has("ffmpeg")) {
-      return false
+  activationDirs() {
+    return {
+      activate: this.kernel.bin.path("miniconda", "etc", "conda", "activate.d"),
+      deactivate: this.kernel.bin.path("miniconda", "etc", "conda", "deactivate.d")
+    }
+  }
+
+  activationHookFiles() {
+    const { activate, deactivate } = this.activationDirs()
+    const files = [
+      {
+        path: path.resolve(activate, "zz_pinokio_ffmpeg.sh"),
+        content: this.posixActivateSh(this.kernel.platform === "win32")
+      },
+      {
+        path: path.resolve(deactivate, "zz_pinokio_ffmpeg.sh"),
+        content: this.posixDeactivateSh(this.kernel.platform === "win32")
+      }
+    ]
+
+    if (this.kernel.platform !== "win32") {
+      return files
+    }
+
+    return files.concat([
+      {
+        path: path.resolve(activate, "zz_pinokio_ffmpeg.bat"),
+        content: this.windowsActivateBat()
+      },
+      {
+        path: path.resolve(deactivate, "zz_pinokio_ffmpeg.bat"),
+        content: this.windowsDeactivateBat()
+      },
+      {
+        path: path.resolve(activate, "zz_pinokio_ffmpeg.ps1"),
+        content: this.windowsActivatePs1()
+      },
+      {
+        path: path.resolve(deactivate, "zz_pinokio_ffmpeg.ps1"),
+        content: this.windowsDeactivatePs1()
+      }
+    ])
+  }
+
+  async ensureBaseActivationHooks() {
+    const dirs = this.activationDirs()
+    await fs.promises.mkdir(dirs.activate, { recursive: true }).catch(() => {})
+    await fs.promises.mkdir(dirs.deactivate, { recursive: true }).catch(() => {})
+    for (const file of this.activationHookFiles()) {
+      await fs.promises.writeFile(file.path, file.content)
+    }
+  }
+
+  async removeBaseActivationHooks() {
+    for (const file of this.activationHookFiles()) {
+      await fs.promises.rm(file.path, { force: true }).catch(() => {})
     }
-    return this.kernel.bin.installed?.conda_versions?.ffmpeg === RELEASE_VERSION
+  }
+
+  windowsActivateBat() {
+    const prefix = this.ffmpegPrefix()
+    const runtime = this.libraryDir()
+    return `@echo off
+set "PINOKIO_FFMPEG_PREFIX=${prefix}"
+set "PINOKIO_FFMPEG_RUNTIME=${runtime}"
+set "FFMPEG_PATH=%PINOKIO_FFMPEG_RUNTIME%\\ffmpeg.exe"
+set "FFPROBE_PATH=%PINOKIO_FFMPEG_RUNTIME%\\ffprobe.exe"
+call :pinokio_ffmpeg_remove_from_path "%PINOKIO_FFMPEG_RUNTIME%"
+set "PATH=%PINOKIO_FFMPEG_RUNTIME%;%PATH%"
+goto :eof
+
+:pinokio_ffmpeg_remove_from_path
+setlocal EnableDelayedExpansion
+set "_pinokio_target=%~1"
+set "_pinokio_path=;%PATH%;"
+set "_pinokio_path=!_pinokio_path:;%_pinokio_target%;=;!"
+set "_pinokio_path=!_pinokio_path:;%_pinokio_target%\\;=;!"
+if "!_pinokio_path:~0,1!"==";" set "_pinokio_path=!_pinokio_path:~1!"
+if "!_pinokio_path:~-1!"==";" set "_pinokio_path=!_pinokio_path:~0,-1!"
+endlocal & set "PATH=%_pinokio_path%"
+exit /b 0
+`
+  }
+
+  windowsDeactivateBat() {
+    return `@echo off
+if defined PINOKIO_FFMPEG_RUNTIME call :pinokio_ffmpeg_remove_from_path "%PINOKIO_FFMPEG_RUNTIME%"
+set "FFMPEG_PATH="
+set "FFPROBE_PATH="
+set "PINOKIO_FFMPEG_PREFIX="
+set "PINOKIO_FFMPEG_RUNTIME="
+goto :eof
+
+:pinokio_ffmpeg_remove_from_path
+setlocal EnableDelayedExpansion
+set "_pinokio_target=%~1"
+set "_pinokio_path=;%PATH%;"
+set "_pinokio_path=!_pinokio_path:;%_pinokio_target%;=;!"
+set "_pinokio_path=!_pinokio_path:;%_pinokio_target%\\;=;!"
+if "!_pinokio_path:~0,1!"==";" set "_pinokio_path=!_pinokio_path:~1!"
+if "!_pinokio_path:~-1!"==";" set "_pinokio_path=!_pinokio_path:~0,-1!"
+endlocal & set "PATH=%_pinokio_path%"
+exit /b 0
+`
+  }
+
+  windowsActivatePs1() {
+    const prefix = this.ffmpegPrefix().replace(/\\/g, "\\\\")
+    const runtime = this.libraryDir().replace(/\\/g, "\\\\")
+    return `$Env:PINOKIO_FFMPEG_PREFIX = "${prefix}"
+$Env:PINOKIO_FFMPEG_RUNTIME = "${runtime}"
+$Env:FFMPEG_PATH = Join-Path $Env:PINOKIO_FFMPEG_RUNTIME "ffmpeg.exe"
+$Env:FFPROBE_PATH = Join-Path $Env:PINOKIO_FFMPEG_RUNTIME "ffprobe.exe"
+$pinokioParts = @()
+if ($Env:Path) {
+  $pinokioParts = @($Env:Path -split ';' | Where-Object { $_ -and $_ -ne $Env:PINOKIO_FFMPEG_RUNTIME })
+}
+$Env:Path = (@($Env:PINOKIO_FFMPEG_RUNTIME) + $pinokioParts) -join ';'
+`
+  }
+
+  windowsDeactivatePs1() {
+    return `if ($Env:PINOKIO_FFMPEG_RUNTIME) {
+  $pinokioParts = @()
+  if ($Env:Path) {
+    $pinokioParts = @($Env:Path -split ';' | Where-Object { $_ -and $_ -ne $Env:PINOKIO_FFMPEG_RUNTIME })
+  }
+  $Env:Path = $pinokioParts -join ';'
+}
+Remove-Item -Path Env:\\FFMPEG_PATH -ErrorAction SilentlyContinue
+Remove-Item -Path Env:\\FFPROBE_PATH -ErrorAction SilentlyContinue
+Remove-Item -Path Env:\\PINOKIO_FFMPEG_PREFIX -ErrorAction SilentlyContinue
+Remove-Item -Path Env:\\PINOKIO_FFMPEG_RUNTIME -ErrorAction SilentlyContinue
+`
+  }
+
+  posixActivateSh(forceWindowsPaths = false) {
+    const prefix = forceWindowsPaths ? Util.p2u(this.ffmpegPrefix()) : this.ffmpegPrefix()
+    const binDir = forceWindowsPaths ? Util.p2u(path.resolve(this.ffmpegPrefix(), "Library", "bin")) : path.resolve(this.ffmpegPrefix(), "bin")
+    const libDir = forceWindowsPaths ? "" : this.libraryDir()
+    return `pinokio_ffmpeg_prepend_path() {
+  local target="$1"
+  local current="\${2-}"
+  local result=""
+  local part
+  local old_ifs="$IFS"
+  IFS=':'
+  for part in $current; do
+    [ -n "$part" ] || continue
+    [ "$part" = "$target" ] && continue
+    if [ -n "$result" ]; then
+      result="$result:$part"
+    else
+      result="$part"
+    fi
+  done
+  IFS="$old_ifs"
+  if [ -n "$result" ]; then
+    printf '%s:%s' "$target" "$result"
+  else
+    printf '%s' "$target"
+  fi
+}
+pinokio_ffmpeg_remove_path() {
+  local target="$1"
+  local current="\${2-}"
+  local result=""
+  local part
+  local old_ifs="$IFS"
+  IFS=':'
+  for part in $current; do
+    [ -n "$part" ] || continue
+    [ "$part" = "$target" ] && continue
+    if [ -n "$result" ]; then
+      result="$result:$part"
+    else
+      result="$part"
+    fi
+  done
+  IFS="$old_ifs"
+  printf '%s' "$result"
+}
+export PINOKIO_FFMPEG_PREFIX="${prefix}"
+export PINOKIO_FFMPEG_BIN="${binDir}"
+export FFMPEG_PATH="$PINOKIO_FFMPEG_BIN/${forceWindowsPaths ? "ffmpeg.exe" : "ffmpeg"}"
+export FFPROBE_PATH="$PINOKIO_FFMPEG_BIN/${forceWindowsPaths ? "ffprobe.exe" : "ffprobe"}"
+export PATH="$(pinokio_ffmpeg_prepend_path "$PINOKIO_FFMPEG_BIN" "$PATH")"
+${forceWindowsPaths ? "" : `if [ "$(uname -s)" = "Linux" ]; then
+  export LD_LIBRARY_PATH="$(pinokio_ffmpeg_prepend_path "${libDir}" "\${LD_LIBRARY_PATH-}")"
+fi
+`}
+unset -f pinokio_ffmpeg_prepend_path
+unset -f pinokio_ffmpeg_remove_path
+`
+  }
+
+  posixDeactivateSh(forceWindowsPaths = false) {
+    return `pinokio_ffmpeg_remove_path() {
+  local target="$1"
+  local current="\${2-}"
+  local result=""
+  local part
+  local old_ifs="$IFS"
+  IFS=':'
+  for part in $current; do
+    [ -n "$part" ] || continue
+    [ "$part" = "$target" ] && continue
+    if [ -n "$result" ]; then
+      result="$result:$part"
+    else
+      result="$part"
+    fi
+  done
+  IFS="$old_ifs"
+  printf '%s' "$result"
+}
+if [ -n "\${PINOKIO_FFMPEG_BIN-}" ]; then
+  export PATH="$(pinokio_ffmpeg_remove_path "$PINOKIO_FFMPEG_BIN" "$PATH")"
+fi
+${forceWindowsPaths ? "" : `if [ "$(uname -s)" = "Linux" ] && [ -n "\${PINOKIO_FFMPEG_PREFIX-}" ]; then
+  export LD_LIBRARY_PATH="$(pinokio_ffmpeg_remove_path "${this.libraryDir()}" "\${LD_LIBRARY_PATH-}")"
+fi
+`}
+unset FFMPEG_PATH
+unset FFPROBE_PATH
+unset PINOKIO_FFMPEG_PREFIX
+unset PINOKIO_FFMPEG_BIN
+unset -f pinokio_ffmpeg_remove_path
+`
   }
 
   async cleanupLegacyStandalone(ondata) {

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "pinokiod",
-  "version": "7.2.4",
+  "version": "7.2.6",
   "description": "",
   "main": "index.js",
   "scripts": {
     "download_readme": "wget -O kernel/proto/PINOKIO.md https://raw.githubusercontent.com/pinokiocomputer/home/refs/heads/main/docs/README.md",
-    "start": "node script/index"
+    "start": "node script/index",
+    "verify:ffmpeg": "node script/verify-ffmpeg.js"
   },
   "author": "",
   "license": "MIT",

package/script/verify-ffmpeg.js

@@ -0,0 +1,459 @@
+#!/usr/bin/env node
+
+const crypto = require("crypto")
+const fs = require("fs")
+const os = require("os")
+const path = require("path")
+const { spawn } = require("child_process")
+const Kernel = require("../kernel")
+
+function parseArgs(argv) {
+  const options = {
+    home: process.env.PINOKIO_HOME || path.resolve(process.cwd(), ".pinokio"),
+    reinstall: false,
+    skipInstall: false,
+  }
+
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i]
+    if (arg === "--home" && argv[i + 1]) {
+      options.home = path.resolve(argv[i + 1])
+      i += 1
+    } else if (arg === "--reinstall") {
+      options.reinstall = true
+    } else if (arg === "--skip-install") {
+      options.skipInstall = true
+    } else if (arg === "--help" || arg === "-h") {
+      options.help = true
+    } else {
+      throw new Error(`Unknown argument: ${arg}`)
+    }
+  }
+
+  return options
+}
+
+function usage() {
+  return [
+    "Usage: node script/verify-ffmpeg.js [--home <PINOKIO_HOME>] [--reinstall] [--skip-install]",
+    "",
+    "--reinstall   remove and reinstall FFmpeg before verification",
+    "--skip-install only verify the current install state",
+  ].join("\n")
+}
+
+function logOnData(event) {
+  if (!event) {
+    return
+  }
+  if (typeof event.raw === "string") {
+    process.stdout.write(event.raw)
+    return
+  }
+  if (typeof event.html === "string") {
+    process.stdout.write(`${event.html.replace(/<[^>]+>/g, "")}\n`)
+  }
+}
+
+function mergeEnv(baseEnv, overlay) {
+  const env = { ...baseEnv }
+  for (const [key, value] of Object.entries(overlay || {})) {
+    if (Array.isArray(value)) {
+      const prefix = value.filter(Boolean).join(path.delimiter)
+      if (prefix.length === 0) {
+        continue
+      }
+      env[key] = env[key] ? `${prefix}${path.delimiter}${env[key]}` : prefix
+    } else if (value === undefined || value === null) {
+      delete env[key]
+    } else {
+      env[key] = String(value)
+    }
+  }
+  return env
+}
+
+function normalizePathForCompare(value) {
+  return String(value || "")
+    .replace(/\\/g, "/")
+    .replace(/\/+$/, "")
+    .toLowerCase()
+}
+
+function assert(condition, message) {
+  if (!condition) {
+    throw new Error(message)
+  }
+}
+
+async function exists(target) {
+  try {
+    await fs.promises.access(target)
+    return true
+  } catch (error) {
+    return false
+  }
+}
+
+async function runCommand(command, args, options = {}) {
+  return await new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd,
+      env: options.env,
+      windowsHide: true,
+      shell: false,
+    })
+
+    let stdout = ""
+    let stderr = ""
+    child.stdout.on("data", (chunk) => {
+      const text = chunk.toString()
+      stdout += text
+      if (options.stream) {
+        process.stdout.write(text)
+      }
+    })
+    child.stderr.on("data", (chunk) => {
+      const text = chunk.toString()
+      stderr += text
+      if (options.stream) {
+        process.stderr.write(text)
+      }
+    })
+    child.on("error", reject)
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve({ stdout, stderr, code })
+      } else {
+        reject(new Error(`Command failed (${code}): ${command} ${args.join(" ")}\n${stdout}${stderr}`))
+      }
+    })
+  })
+}
+
+function prefixedValue(output, prefix) {
+  const line = String(output || "").split(/\r?\n/).find((entry) => entry.startsWith(prefix))
+  if (!line) {
+    return ""
+  }
+  return line.slice(prefix.length)
+}
+
+function sectionValues(output, beginMarker, endMarker) {
+  const lines = String(output || "").split(/\r?\n/)
+  const begin = lines.findIndex((line) => line.trim() === beginMarker)
+  const end = lines.findIndex((line, index) => index > begin && line.trim() === endMarker)
+  if (begin === -1 || end === -1 || end <= begin) {
+    return []
+  }
+  return lines.slice(begin + 1, end).map((line) => line.trim()).filter(Boolean)
+}
+
+async function verifyHookFiles(ffmpeg) {
+  const hookFiles = ffmpeg.activationHookFiles()
+  for (const file of hookFiles) {
+    assert(await exists(file.path), `Missing activation hook: ${file.path}`)
+  }
+}
+
+async function verifyWindowsPatchedCache(ffmpeg) {
+  if (ffmpeg.kernel.platform !== "win32") {
+    return
+  }
+
+  const pkgsDir = ffmpeg.ffmpegPkgsDir()
+  const entries = await fs.promises.readdir(pkgsDir, { withFileTypes: true })
+  const packageDirs = entries
+    .filter((entry) => entry.isDirectory() && /^gdk-pixbuf-/.test(entry.name))
+    .map((entry) => path.resolve(pkgsDir, entry.name))
+
+  assert(packageDirs.length > 0, `No gdk-pixbuf package found under ${pkgsDir}`)
+
+  for (const packageDir of packageDirs) {
+    const scriptPath = path.resolve(packageDir, "Scripts", ".gdk-pixbuf-post-link.bat")
+    assert(await exists(scriptPath), `Missing patched gdk-pixbuf script: ${scriptPath}`)
+
+    const contents = await fs.promises.readFile(scriptPath)
+    assert(
+      contents.toString("utf8").includes("Pinokio intentionally skips gdk-pixbuf loader cache generation"),
+      `Unexpected gdk-pixbuf post-link contents in ${scriptPath}`
+    )
+
+    const pathsJsonPath = path.resolve(packageDir, "info", "paths.json")
+    const pathsJson = JSON.parse(await fs.promises.readFile(pathsJsonPath, "utf8"))
+    const entry = Array.isArray(pathsJson.paths)
+      ? pathsJson.paths.find((item) => item && item._path === "Scripts/.gdk-pixbuf-post-link.bat")
+      : null
+
+    assert(entry, `Missing paths.json entry for patched gdk-pixbuf script in ${pathsJsonPath}`)
+    assert(entry.size_in_bytes === contents.length, `paths.json size mismatch for ${scriptPath}`)
+
+    const sha256 = crypto.createHash("sha256").update(contents).digest("hex")
+    assert(entry.sha256 === sha256, `paths.json sha256 mismatch for ${scriptPath}`)
+  }
+}
+
+async function verifyPosixRuntime(ffmpeg, condaEnv) {
+  const shell = "/bin/bash"
+  const env = mergeEnv(process.env, condaEnv)
+  const expectedFfmpeg = ffmpeg.binaryPath("ffmpeg")
+  const expectedFfprobe = ffmpeg.binaryPath("ffprobe")
+  const expectedBinDir = path.dirname(expectedFfmpeg)
+  const expectedLibDir = ffmpeg.libraryDir()
+
+  const command = [
+    "set -e",
+    'eval "$(conda shell.bash hook)"',
+    "conda deactivate || true",
+    "conda deactivate || true",
+    "conda deactivate || true",
+    "conda activate base",
+    'printf "__FFMPEG__%s\\n" "$(command -v ffmpeg)"',
+    'printf "__FFPROBE__%s\\n" "$(command -v ffprobe)"',
+    'printf "__FFMPEG_PATH__%s\\n" "${FFMPEG_PATH-}"',
+    'printf "__FFPROBE_PATH__%s\\n" "${FFPROBE_PATH-}"',
+    'printf "__PATH__%s\\n" "$PATH"',
+    ffmpeg.kernel.platform === "linux"
+      ? 'printf "__LD_LIBRARY_PATH__%s\\n" "${LD_LIBRARY_PATH-}"'
+      : 'printf "__LD_LIBRARY_PATH__%s\\n" "${LD_LIBRARY_PATH-}"',
+    "ffmpeg -hide_banner -version | head -n 1",
+    "ffprobe -hide_banner -version | head -n 1",
+    "ffmpeg -hide_banner -encoders | grep -q libmp3lame",
+  ].join(" && ")
+
+  const { stdout } = await runCommand(shell, ["-lc", command], { env, stream: true })
+  const ffmpegResolved = prefixedValue(stdout, "__FFMPEG__")
+  const ffprobeResolved = prefixedValue(stdout, "__FFPROBE__")
+  const ffmpegPathEnv = prefixedValue(stdout, "__FFMPEG_PATH__")
+  const ffprobePathEnv = prefixedValue(stdout, "__FFPROBE_PATH__")
+  const shellPath = prefixedValue(stdout, "__PATH__")
+  const ldLibraryPath = prefixedValue(stdout, "__LD_LIBRARY_PATH__")
+
+  assert(
+    normalizePathForCompare(ffmpegResolved) === normalizePathForCompare(expectedFfmpeg),
+    `bash resolved ffmpeg to ${ffmpegResolved}, expected ${expectedFfmpeg}`
+  )
+  assert(
+    normalizePathForCompare(ffprobeResolved) === normalizePathForCompare(expectedFfprobe),
+    `bash resolved ffprobe to ${ffprobeResolved}, expected ${expectedFfprobe}`
+  )
+  assert(
+    normalizePathForCompare(ffmpegPathEnv) === normalizePathForCompare(expectedFfmpeg),
+    `FFMPEG_PATH was ${ffmpegPathEnv}, expected ${expectedFfmpeg}`
+  )
+  assert(
+    normalizePathForCompare(ffprobePathEnv) === normalizePathForCompare(expectedFfprobe),
+    `FFPROBE_PATH was ${ffprobePathEnv}, expected ${expectedFfprobe}`
+  )
+  assert(
+    shellPath.split(":").map((entry) => normalizePathForCompare(entry))[0] === normalizePathForCompare(expectedBinDir),
+    `PATH does not start with FFmpeg bin dir: ${expectedBinDir}`
+  )
+  if (ffmpeg.kernel.platform === "linux") {
+    assert(
+      ldLibraryPath.split(":").map((entry) => normalizePathForCompare(entry))[0] === normalizePathForCompare(expectedLibDir),
+      `LD_LIBRARY_PATH does not start with FFmpeg lib dir: ${expectedLibDir}`
+    )
+  }
+}
+
+async function verifyWindowsCmdRuntime(ffmpeg, condaEnv) {
+  const env = mergeEnv(process.env, condaEnv)
+  const expectedFfmpeg = ffmpeg.binaryPath("ffmpeg")
+  const expectedFfprobe = ffmpeg.binaryPath("ffprobe")
+  const expectedRuntimeDir = ffmpeg.libraryDir()
+
+  const command = [
+    "conda_hook",
+    "conda deactivate",
+    "conda deactivate",
+    "conda deactivate",
+    [
+      "conda activate base",
+      "echo __FFMPEG_PATH__%FFMPEG_PATH%",
+      "echo __FFPROBE_PATH__%FFPROBE_PATH%",
+      "echo __PATH__%PATH%",
+      "echo __FFMPEG_BEGIN__",
+      "where ffmpeg",
+      "echo __FFMPEG_END__",
+      "echo __FFPROBE_BEGIN__",
+      "where ffprobe",
+      "echo __FFPROBE_END__",
+      "ffmpeg -hide_banner -version",
+      "ffprobe -hide_banner -version",
+      'ffmpeg -hide_banner -encoders | findstr /C:"libmp3lame"',
+    ].join(" && "),
+  ].join(" & ")
+
+  const shell = process.env.ComSpec || "cmd.exe"
+  const { stdout } = await runCommand(shell, ["/d", "/s", "/c", command], { env, stream: true })
+
+  const ffmpegPathEnv = prefixedValue(stdout, "__FFMPEG_PATH__")
+  const ffprobePathEnv = prefixedValue(stdout, "__FFPROBE_PATH__")
+  const shellPath = prefixedValue(stdout, "__PATH__")
+  const ffmpegResolved = sectionValues(stdout, "__FFMPEG_BEGIN__", "__FFMPEG_END__")[0]
+  const ffprobeResolved = sectionValues(stdout, "__FFPROBE_BEGIN__", "__FFPROBE_END__")[0]
+
+  assert(
+    normalizePathForCompare(ffmpegResolved) === normalizePathForCompare(expectedFfmpeg),
+    `cmd resolved ffmpeg to ${ffmpegResolved}, expected ${expectedFfmpeg}`
+  )
+  assert(
+    normalizePathForCompare(ffprobeResolved) === normalizePathForCompare(expectedFfprobe),
+    `cmd resolved ffprobe to ${ffprobeResolved}, expected ${expectedFfprobe}`
+  )
+  assert(
+    normalizePathForCompare(ffmpegPathEnv) === normalizePathForCompare(expectedFfmpeg),
+    `FFMPEG_PATH was ${ffmpegPathEnv}, expected ${expectedFfmpeg}`
+  )
+  assert(
+    normalizePathForCompare(ffprobePathEnv) === normalizePathForCompare(expectedFfprobe),
+    `FFPROBE_PATH was ${ffprobePathEnv}, expected ${expectedFfprobe}`
+  )
+  assert(
+    shellPath.split(";").map((entry) => normalizePathForCompare(entry))[0] === normalizePathForCompare(expectedRuntimeDir),
+    `PATH does not start with FFmpeg runtime dir: ${expectedRuntimeDir}`
+  )
+}
+
+async function verifyWindowsPowerShellRuntime(ffmpeg, condaEnv) {
+  const env = mergeEnv(process.env, condaEnv)
+  const expectedFfmpeg = ffmpeg.binaryPath("ffmpeg")
+  const expectedFfprobe = ffmpeg.binaryPath("ffprobe")
+  const expectedRuntimeDir = ffmpeg.libraryDir()
+
+  const script = [
+    "$ErrorActionPreference = 'Stop'",
+    "conda_hook",
+    "conda deactivate",
+    "conda deactivate",
+    "conda deactivate",
+    "conda activate base",
+    'Write-Output ("__FFMPEG_PATH__" + $Env:FFMPEG_PATH)',
+    'Write-Output ("__FFPROBE_PATH__" + $Env:FFPROBE_PATH)',
+    'Write-Output ("__PATH__" + $Env:Path)',
+    'Write-Output ("__FFMPEG__" + (Get-Command ffmpeg).Source)',
+    'Write-Output ("__FFPROBE__" + (Get-Command ffprobe).Source)',
+    "ffmpeg -hide_banner -version | Select-Object -First 1",
+    "ffprobe -hide_banner -version | Select-Object -First 1",
+    "if (-not (ffmpeg -hide_banner -encoders | Select-String -SimpleMatch 'libmp3lame')) { exit 1 }",
+  ].join("; ")
+
+  const shell = process.env.SystemRoot
+    ? path.resolve(process.env.SystemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
+    : "powershell.exe"
+  const { stdout } = await runCommand(shell, ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script], { env, stream: true })
+
+  const ffmpegResolved = prefixedValue(stdout, "__FFMPEG__")
+  const ffprobeResolved = prefixedValue(stdout, "__FFPROBE__")
+  const ffmpegPathEnv = prefixedValue(stdout, "__FFMPEG_PATH__")
+  const ffprobePathEnv = prefixedValue(stdout, "__FFPROBE_PATH__")
+  const shellPath = prefixedValue(stdout, "__PATH__")
+
+  assert(
+    normalizePathForCompare(ffmpegResolved) === normalizePathForCompare(expectedFfmpeg),
+    `PowerShell resolved ffmpeg to ${ffmpegResolved}, expected ${expectedFfmpeg}`
+  )
+  assert(
+    normalizePathForCompare(ffprobeResolved) === normalizePathForCompare(expectedFfprobe),
+    `PowerShell resolved ffprobe to ${ffprobeResolved}, expected ${expectedFfprobe}`
+  )
+  assert(
+    normalizePathForCompare(ffmpegPathEnv) === normalizePathForCompare(expectedFfmpeg),
+    `PowerShell FFMPEG_PATH was ${ffmpegPathEnv}, expected ${expectedFfmpeg}`
+  )
+  assert(
+    normalizePathForCompare(ffprobePathEnv) === normalizePathForCompare(expectedFfprobe),
+    `PowerShell FFPROBE_PATH was ${ffprobePathEnv}, expected ${expectedFfprobe}`
+  )
+  assert(
+    shellPath.split(";").map((entry) => normalizePathForCompare(entry))[0] === normalizePathForCompare(expectedRuntimeDir),
+    `PowerShell PATH does not start with FFmpeg runtime dir: ${expectedRuntimeDir}`
+  )
+}
+
+async function main() {
+  const options = parseArgs(process.argv.slice(2))
+  if (options.help) {
+    console.log(usage())
+    return
+  }
+
+  process.env.PINOKIO_HOME = options.home
+  console.log(`[verify-ffmpeg] home=${options.home}`)
+  console.log(`[verify-ffmpeg] platform=${os.platform()} arch=${os.arch()}`)
+
+  const kernel = new Kernel({ store: {} })
+  await kernel.init({})
+  await kernel.shell.init()
+  await kernel.bin.init()
+  await kernel.bin.refreshInstalled()
+
+  if (kernel.refresh_interval) {
+    clearInterval(kernel.refresh_interval)
+  }
+  kernel.server_running = true
+
+  const conda = kernel.bin.mod("conda")
+  const ffmpeg = kernel.bin.mod("ffmpeg")
+
+  assert(conda, "Conda module was not initialized")
+  assert(ffmpeg, "FFmpeg module was not initialized")
+
+  if (!kernel.bin.installed.conda || !(await conda.installed())) {
+    console.log("[verify-ffmpeg] installing conda")
+    await kernel.bin.install({
+      params: [
+        {
+          name: "conda",
+          dependencies: [],
+        }
+      ]
+    }, logOnData)
+    await kernel.bin.refreshInstalled()
+  }
+
+  if (!options.skipInstall) {
+    const ffmpegInstalled = await ffmpeg.installed()
+    if (options.reinstall && ffmpegInstalled) {
+      console.log("[verify-ffmpeg] reinstall requested, removing existing ffmpeg")
+      await ffmpeg.uninstall({}, logOnData)
+      await kernel.bin.refreshInstalled()
+    }
+    if (options.reinstall || !(await ffmpeg.installed())) {
+      console.log("[verify-ffmpeg] installing ffmpeg")
+      await kernel.bin.install({
+        params: [
+          {
+            name: "ffmpeg",
+          }
+        ]
+      }, logOnData)
+      await kernel.bin.refreshInstalled()
+    }
+  }
+
+  assert(await ffmpeg.installed(), "FFmpeg module did not report installed after setup")
+  await ffmpeg.selfTest(logOnData)
+  await verifyHookFiles(ffmpeg)
+  await verifyWindowsPatchedCache(ffmpeg)
+
+  const condaEnv = conda.env()
+  if (kernel.platform === "win32") {
+    console.log("[verify-ffmpeg] verifying cmd.exe runtime")
+    await verifyWindowsCmdRuntime(ffmpeg, condaEnv)
+    console.log("[verify-ffmpeg] verifying PowerShell runtime")
+    await verifyWindowsPowerShellRuntime(ffmpeg, condaEnv)
+  } else {
+    console.log("[verify-ffmpeg] verifying bash runtime")
+    await verifyPosixRuntime(ffmpeg, condaEnv)
+  }
+
+  console.log("[verify-ffmpeg] all checks passed")
+}
+
+main().catch((error) => {
+  console.error("[verify-ffmpeg] failed")
+  console.error(error && error.stack ? error.stack : error)
+  process.exit(1)
+})