pinokiod 7.5.29 → 7.5.31

package/kernel/bin/conda-meta.js

@@ -69,15 +69,27 @@ async function runCondaList(minicondaPath) {
   })
 }
 
-function resolveCondaBinary(minicondaPath) {
-  if (process.platform === 'win32') {
+async function managedCondaRuns(minicondaPath, platform = process.platform) {
+  const condaBinary = resolveCondaBinary(minicondaPath, platform, false)
+  if (!condaBinary) {
+    return false
+  }
+  return await new Promise((resolve) => {
+    execFile(condaBinary, ['--version'], { windowsHide: true, timeout: 15000 }, (err) => {
+      resolve(!err)
+    })
+  })
+}
+
+function resolveCondaBinary(minicondaPath, platform = process.platform, allowFallback = true) {
+  if (platform === 'win32') {
     if (minicondaPath) {
       const scriptPath = path.join(minicondaPath, 'Scripts', 'conda.exe')
       if (fs.existsSync(scriptPath)) {
         return scriptPath
       }
     }
-    return 'conda'
+    return allowFallback ? 'conda' : null
   }
   if (minicondaPath) {
     const binPath = path.join(minicondaPath, 'bin', 'conda')
@@ -85,9 +97,10 @@ function resolveCondaBinary(minicondaPath) {
       return binPath
     }
   }
-  return 'conda'
+  return allowFallback ? 'conda' : null
 }
 
 module.exports = {
-  buildCondaListFromMeta
+  buildCondaListFromMeta,
+  managedCondaRuns,
 }

package/kernel/bin/conda.js

@@ -2,7 +2,7 @@ const fs = require('fs')
 const path = require('path')
 const { glob } = require('glob')
 const semver = require('semver')
-const { buildCondaListFromMeta } = require('./conda-meta')
+const { buildCondaListFromMeta, managedCondaRuns } = require('./conda-meta')
 const {
   CONDA_PIN_VERSION,
   PYTHON_INSTALL_SPEC,
@@ -14,6 +14,61 @@ const MINIFORGE_RELEASE = "26.3.2-3"
 const MINIFORGE_BASE_URL = `https://github.com/conda-forge/miniforge/releases/download/${MINIFORGE_RELEASE}`
 const CONDA_ROOT_DIR = "miniforge"
 const LEGACY_CONDA_ROOT_DIR = "miniconda"
+const WINDOWS_OPENSSL_HOOKS = {
+  activate: {
+    "openssl_activate-win.bat": [
+      "@echo off",
+      'if "%SSL_CERT_FILE%"=="" (',
+      '    set "SSL_CERT_FILE=%CONDA_PREFIX%\\Library\\ssl\\cacert.pem"',
+      '    set "__CONDA_OPENSSL_CERT_FILE_SET=1"',
+      ")",
+      "",
+    ].join("\r\n"),
+    "openssl_activate-win.ps1": [
+      "if (-not $Env:SSL_CERT_FILE) {",
+      '    $Env:SSL_CERT_FILE = "$Env:CONDA_PREFIX\\Library\\ssl\\cacert.pem"',
+      '    $Env:__CONDA_OPENSSL_CERT_FILE_SET = "1"',
+      "}",
+      "",
+    ].join("\r\n"),
+    "openssl_activate-win.sh": [
+      'if [[ "${SSL_CERT_FILE:-}" == "" ]]; then',
+      '    export SSL_CERT_FILE="${CONDA_PREFIX}\\\\Library\\\\ssl\\\\cacert.pem"',
+      '    export __CONDA_OPENSSL_CERT_FILE_SET="1"',
+      "fi",
+      "",
+    ].join("\n"),
+  },
+  deactivate: {
+    "openssl_deactivate-win.bat": [
+      "@echo off",
+      'if "%__CONDA_OPENSSL_CERT_FILE_SET%" == "1" (',
+      "    set SSL_CERT_FILE=",
+      "    set __CONDA_OPENSSL_CERT_FILE_SET=",
+      ")",
+      "",
+    ].join("\r\n"),
+    "openssl_deactivate-win.ps1": [
+      'if ($Env:__CONDA_OPENSSL_CERT_FILE_SET -eq "1") {',
+      "    Remove-Item -Path Env:\\SSL_CERT_FILE",
+      "    Remove-Item -Path Env:\\__CONDA_OPENSSL_CERT_FILE_SET",
+      "}",
+      "",
+    ].join("\r\n"),
+    "openssl_deactivate-win.sh": [
+      'if [[ "${__CONDA_OPENSSL_CERT_FILE_SET:-}" == "1" ]]; then',
+      "    unset SSL_CERT_FILE",
+      "    unset __CONDA_OPENSSL_CERT_FILE_SET",
+      "fi",
+      "",
+    ].join("\n"),
+  },
+}
+const LEGACY_SSL_CERT_DIR_HOOK_FILES = [
+  "zz_pinokio_unset_ssl_cert_dir-win.bat",
+  "zz_pinokio_unset_ssl_cert_dir-win.ps1",
+  "zz_pinokio_unset_ssl_cert_dir-win.sh",
+]
 
 class Conda {
   description = "Pinokio uses Conda to install various useful programs in an isolated manner."
@@ -69,37 +124,42 @@ class Conda {
     }
     return base
   }
-  async ensureSslCertDirOverride() {
+  async ensureWindowsOpenSslHooks() {
     if (this.kernel.platform !== "win32") {
       return
     }
-    if (!(await this.hasCondaMeta())) {
+    const condaRootDirs = []
+    for (const rootDir of [CONDA_ROOT_DIR, LEGACY_CONDA_ROOT_DIR]) {
+      if (await this.kernel.exists(`bin/${rootDir}/conda-meta`)) {
+        condaRootDirs.push(rootDir)
+      }
+    }
+    if (condaRootDirs.length === 0) {
       return
     }
-    const activateDir = this.kernel.bin.path(`${CONDA_ROOT_DIR}/etc/conda/activate.d`)
-    await fs.promises.mkdir(activateDir, { recursive: true }).catch(() => {})
-    await fs.promises.writeFile(
-      path.resolve(activateDir, "zz_pinokio_unset_ssl_cert_dir-win.bat"),
-      `@echo off
-if "%__CONDA_OPENSSL_CERT_DIR_SET%"=="1" (
-    set "SSL_CERT_DIR="
-)
-`
-    )
-    await fs.promises.writeFile(
-      path.resolve(activateDir, "zz_pinokio_unset_ssl_cert_dir-win.ps1"),
-      `if ($Env:__CONDA_OPENSSL_CERT_DIR_SET -eq "1") {
-  Remove-Item -Path Env:\\SSL_CERT_DIR -ErrorAction SilentlyContinue
-}
-`
-    )
-    await fs.promises.writeFile(
-      path.resolve(activateDir, "zz_pinokio_unset_ssl_cert_dir-win.sh"),
-      `if [[ "\${__CONDA_OPENSSL_CERT_DIR_SET:-}" == "1" ]]; then
-  unset SSL_CERT_DIR
-fi
-`
-    )
+    for (const rootDir of condaRootDirs) {
+      const activateDir = this.kernel.bin.path(`${rootDir}/etc/conda/activate.d`)
+      const deactivateDir = this.kernel.bin.path(`${rootDir}/etc/conda/deactivate.d`)
+      for (const hookDir of [activateDir, deactivateDir]) {
+        for (const filename of LEGACY_SSL_CERT_DIR_HOOK_FILES) {
+          await fs.promises.rm(path.resolve(hookDir, filename), { force: true }).catch(() => {})
+        }
+      }
+      for (const [filename, content] of Object.entries(WINDOWS_OPENSSL_HOOKS.activate)) {
+        const hookPath = path.resolve(activateDir, filename)
+        const exists = await fs.promises.access(hookPath).then(() => true).catch(() => false)
+        if (exists) {
+          await fs.promises.writeFile(hookPath, content)
+        }
+      }
+      for (const [filename, content] of Object.entries(WINDOWS_OPENSSL_HOOKS.deactivate)) {
+        const hookPath = path.resolve(deactivateDir, filename)
+        const exists = await fs.promises.access(hookPath).then(() => true).catch(() => false)
+        if (exists) {
+          await fs.promises.writeFile(hookPath, content)
+        }
+      }
+    }
   }
   async init() {
     if (this.kernel.homedir) {
@@ -120,9 +180,9 @@ report_errors: false`)
       let pinned_exists = await this.hasCondaMeta()
       if (pinned_exists) {
         await fs.promises.writeFile(this.kernel.path(`bin/${CONDA_ROOT_DIR}/conda-meta/pinned`), this.pinnedPackages())
-        await this.ensureSslCertDirOverride()
         await this.ensureCompatibilityAlias()
       }
+      await this.ensureWindowsOpenSslHooks()
     }
   }
   async check() {
@@ -170,7 +230,10 @@ report_errors: false`)
     this.kernel.bin.installed.conda = conda
     this.kernel.bin.installed.conda_versions = conda_versions
     this.kernel.bin.installed.conda_builds = conda_builds
-    return conda_check.conda && conda_check.mamba && conda_check.python
+    if (!(conda_check.conda && conda_check.mamba && conda_check.python)) {
+      return false
+    }
+    return await managedCondaRuns(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.platform)
   }
   async install(req, ondata) {
     for(let i=0; i<5; i++) {
@@ -267,7 +330,7 @@ report_errors: false`)
         this.kernel.bin.path(CONDA_ROOT_DIR, "python3.exe"),
       )
     }
-    await this.ensureSslCertDirOverride()
+    await this.ensureWindowsOpenSslHooks()
     await this.ensureCompatibilityAlias()
     ondata({ raw: `Install finished\r\n` })
     await this.kernel.bin.rm(installer, ondata)

package/kernel/bin/index.js

@@ -21,7 +21,7 @@ const LLVM = require('./llvm')
 const VS = require("./vs")
 const Cuda = require("./cuda")
 const Torch = require("./torch")
-const { buildCondaListFromMeta } = require('./conda-meta')
+const { buildCondaListFromMeta, managedCondaRuns } = require('./conda-meta')
 const {
   isExpectedPythonPinned,
 } = require('./conda-pins')
@@ -412,7 +412,7 @@ class Bin {
       }
 
       if (conda_check.conda && conda_check.mamba && conda_check.python) {
-        this.correct_conda = true
+        this.correct_conda = await managedCondaRuns(this.kernel.bin.path("miniforge"), this.platform)
       }
     }
     this.installed.conda = conda
@@ -448,6 +448,9 @@ class Bin {
           break 
         }
       }
+      if (this.mod && this.mod.conda && this.mod.conda.ensureWindowsOpenSslHooks) {
+        await this.mod.conda.ensureWindowsOpenSslHooks()
+      }
     }
 
     if (this.platform === "darwin") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "7.5.29",
+  "version": "7.5.31",
   "description": "",
   "main": "index.js",
   "scripts": {

package/server/index.js

@@ -6041,6 +6041,13 @@ class Server {
       if (version === this.version.pinokiod) {
         console.log("version up to date")
       } else if (!(await fse.pathExists(path.resolve(home, "bin/miniforge/conda-meta")))) {
+        // if miniconda => miniforge migration hasn't happened yet
+        if (!(await fse.pathExists(path.resolve(home, "bin/miniconda/conda-meta")))) {
+          // if miniconda folder does NOT exist (new user), set version
+          // if miniconda folder exists (existing user), don't set version yet
+          //    => version only set after miniconda => miniforge migration has happened
+          this.kernel.store.set("version", this.version.pinokiod)
+        }
         console.warn("[WARN] Managed home refresh deferred until Miniforge is installed")
       } else {
         // For every update, this gets triggered exactly once.

package/server/public/style.css

@@ -1284,6 +1284,10 @@ body.main-sidebar-page .navheader {
   box-shadow: none;
   isolation: isolate;
 }
+body.main-sidebar-page > header.navheader h1,
+body.app-page > header.navheader h1 {
+  gap: 6px;
+}
 body.main-sidebar-page .navheader .sidebar-toggle {
   color: #0f172a;
   position: relative;

package/test/conda-bin.test.js

@@ -25,12 +25,38 @@ function createKernel(root, platform = 'win32') {
     exists: async (...parts) => pathExists(path.join(root, ...parts)),
     bin: {
       correct_conda: true,
+      installed: {},
       path: (...parts) => path.join(root, 'bin', ...parts),
       exists: async (target) => pathExists(path.join(root, 'bin', target)),
     },
   }
 }
 
+async function writeCondaMeta(root, name, version, build = 'py_0') {
+  const metaDir = path.join(root, 'bin', 'miniforge', 'conda-meta')
+  await fs.mkdir(metaDir, { recursive: true })
+  await fs.writeFile(
+    path.join(metaDir, `${name}-${version}.json`),
+    JSON.stringify({ name, version, build_string: build, channel: 'conda-forge' })
+  )
+}
+
+async function writeHealthyCondaMeta(root, platform = 'win32') {
+  await writeCondaMeta(root, 'conda', '26.3.2', 'py310')
+  await writeCondaMeta(root, 'conda-libmamba-solver', '25.4.0', 'pyhd3eb1b0_0')
+  await writeCondaMeta(root, 'python', '3.10.20', platform === 'win32' ? 'h4de0772_1_cpython' : 'cpython')
+}
+
+async function writeFakeManagedConda(root, platform = 'win32') {
+  const condaPath = platform === 'win32'
+    ? path.join(root, 'bin', 'miniforge', 'Scripts', 'conda.exe')
+    : path.join(root, 'bin', 'miniforge', 'bin', 'conda')
+  await fs.mkdir(path.dirname(condaPath), { recursive: true })
+  await fs.copyFile(process.execPath, condaPath)
+  await fs.chmod(condaPath, 0o755)
+  return condaPath
+}
+
 async function createCondaRoot(root, name) {
   const condaRoot = path.join(root, 'bin', name)
   await fs.mkdir(path.join(condaRoot, 'Scripts'), { recursive: true })
@@ -52,6 +78,88 @@ function createConda(kernel) {
   return conda
 }
 
+const EXPECTED_WINDOWS_OPENSSL_HOOKS = {
+  [path.join('activate.d', 'openssl_activate-win.bat')]: [
+    '@echo off',
+    'if "%SSL_CERT_FILE%"=="" (',
+    '    set "SSL_CERT_FILE=%CONDA_PREFIX%\\Library\\ssl\\cacert.pem"',
+    '    set "__CONDA_OPENSSL_CERT_FILE_SET=1"',
+    ')',
+    '',
+  ].join('\r\n'),
+  [path.join('activate.d', 'openssl_activate-win.ps1')]: [
+    'if (-not $Env:SSL_CERT_FILE) {',
+    '    $Env:SSL_CERT_FILE = "$Env:CONDA_PREFIX\\Library\\ssl\\cacert.pem"',
+    '    $Env:__CONDA_OPENSSL_CERT_FILE_SET = "1"',
+    '}',
+    '',
+  ].join('\r\n'),
+  [path.join('activate.d', 'openssl_activate-win.sh')]: [
+    'if [[ "${SSL_CERT_FILE:-}" == "" ]]; then',
+    '    export SSL_CERT_FILE="${CONDA_PREFIX}\\\\Library\\\\ssl\\\\cacert.pem"',
+    '    export __CONDA_OPENSSL_CERT_FILE_SET="1"',
+    'fi',
+    '',
+  ].join('\n'),
+  [path.join('deactivate.d', 'openssl_deactivate-win.bat')]: [
+    '@echo off',
+    'if "%__CONDA_OPENSSL_CERT_FILE_SET%" == "1" (',
+    '    set SSL_CERT_FILE=',
+    '    set __CONDA_OPENSSL_CERT_FILE_SET=',
+    ')',
+    '',
+  ].join('\r\n'),
+  [path.join('deactivate.d', 'openssl_deactivate-win.ps1')]: [
+    'if ($Env:__CONDA_OPENSSL_CERT_FILE_SET -eq "1") {',
+    '    Remove-Item -Path Env:\\SSL_CERT_FILE',
+    '    Remove-Item -Path Env:\\__CONDA_OPENSSL_CERT_FILE_SET',
+    '}',
+    '',
+  ].join('\r\n'),
+  [path.join('deactivate.d', 'openssl_deactivate-win.sh')]: [
+    'if [[ "${__CONDA_OPENSSL_CERT_FILE_SET:-}" == "1" ]]; then',
+    '    unset SSL_CERT_FILE',
+    '    unset __CONDA_OPENSSL_CERT_FILE_SET',
+    'fi',
+    '',
+  ].join('\n'),
+}
+
+async function seedWindowsOpenSslHooks(root, condaRootName) {
+  const condaHookRoot = path.join(root, 'bin', condaRootName, 'etc', 'conda')
+  for (const hookRelativePath of Object.keys(EXPECTED_WINDOWS_OPENSSL_HOOKS)) {
+    const hookPath = path.join(condaHookRoot, hookRelativePath)
+    await fs.mkdir(path.dirname(hookPath), { recursive: true })
+    await fs.writeFile(hookPath, 'upstream hook with SSL_CERT_DIR\n')
+  }
+  for (const hookDirName of ['activate.d', 'deactivate.d']) {
+    for (const filename of [
+      'zz_pinokio_unset_ssl_cert_dir-win.bat',
+      'zz_pinokio_unset_ssl_cert_dir-win.ps1',
+      'zz_pinokio_unset_ssl_cert_dir-win.sh',
+    ]) {
+      await fs.writeFile(path.join(condaHookRoot, hookDirName, filename), 'legacy hook\n')
+    }
+  }
+}
+
+async function assertWindowsOpenSslHooksPatched(root, condaRootName) {
+  const condaHookRoot = path.join(root, 'bin', condaRootName, 'etc', 'conda')
+  for (const [hookRelativePath, expectedContent] of Object.entries(EXPECTED_WINDOWS_OPENSSL_HOOKS)) {
+    const hookPath = path.join(condaHookRoot, hookRelativePath)
+    assert.equal(await fs.readFile(hookPath, 'utf8'), expectedContent)
+  }
+  for (const hookDirName of ['activate.d', 'deactivate.d']) {
+    for (const filename of [
+      'zz_pinokio_unset_ssl_cert_dir-win.bat',
+      'zz_pinokio_unset_ssl_cert_dir-win.ps1',
+      'zz_pinokio_unset_ssl_cert_dir-win.sh',
+    ]) {
+      assert.equal(await pathExists(path.join(condaHookRoot, hookDirName, filename)), false)
+    }
+  }
+}
+
 test('Conda uses Miniforge assets and writes conda-forge-only config', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-miniforge-config-'))
   const conda = createConda(createKernel(root))
@@ -73,17 +181,26 @@ test('Conda uses Miniforge assets and writes conda-forge-only config', async ()
   assert.equal(await pathExists(path.join(root, 'bin', 'miniforge')), false)
 })
 
-test('Conda init writes activation hooks only after Miniforge exists', async () => {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-init-hooks-'))
+test('Conda init patches Windows OpenSSL hooks and removes legacy SSL_CERT_DIR hooks', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-openssl-hooks-'))
   await fs.mkdir(path.join(root, 'bin', 'miniforge', 'conda-meta'), { recursive: true })
+  await seedWindowsOpenSslHooks(root, 'miniforge')
   const conda = createConda(createKernel(root))
 
   await conda.init()
 
-  assert.equal(
-    await pathExists(path.join(root, 'bin', 'miniforge', 'etc', 'conda', 'activate.d', 'zz_pinokio_unset_ssl_cert_dir-win.bat')),
-    true
-  )
+  await assertWindowsOpenSslHooksPatched(root, 'miniforge')
+})
+
+test('Conda init patches Windows OpenSSL hooks for legacy Miniconda roots', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-legacy-openssl-hooks-'))
+  await fs.mkdir(path.join(root, 'bin', 'miniconda', 'conda-meta'), { recursive: true })
+  await seedWindowsOpenSslHooks(root, 'miniconda')
+  const conda = createConda(createKernel(root))
+
+  await conda.init()
+
+  await assertWindowsOpenSslHooksPatched(root, 'miniconda')
 })
 
 test('Conda pins Python 3.10.20 consistently across platforms', async () => {
@@ -207,6 +324,21 @@ test('Conda installed stays false when metadata check already marked Conda inval
   assert.equal(await createConda(kernel).installed(), false)
 })
 
+test('Conda check rejects metadata-only Windows installs', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-smoke-missing-'))
+  await writeHealthyCondaMeta(root, 'win32')
+
+  assert.equal(await createConda(createKernel(root, 'win32')).check(), false)
+})
+
+test('Conda check accepts a runnable managed Windows conda executable', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-smoke-runnable-'))
+  await writeHealthyCondaMeta(root, 'win32')
+  await writeFakeManagedConda(root, 'win32')
+
+  assert.equal(await createConda(createKernel(root, 'win32')).check(), true)
+})
+
 test('Conda install keeps the old runtime when the replacement installer download fails', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-download-fails-'))
   const miniconda = await createLegacyMiniconda(root)