pinokiod 7.5.32 → 7.5.34

package/kernel/bin/conda-pins.js

@@ -1,6 +1,6 @@
 const semver = require('semver')
 
-const CONDA_PIN_VERSION = "26.5.2"
+const CONDA_PIN_VERSION = "26.3.2"
 const PYTHON_PIN_VERSION = "3.10.20"
 const PYTHON_INSTALL_SPEC = `python=${PYTHON_PIN_VERSION}`
 const WINDOWS_PYTHON_SSL_FIX_SPEC = `${PYTHON_INSTALL_SPEC}=*_1_cpython`

package/kernel/bin/conda.js

@@ -69,6 +69,76 @@ const LEGACY_SSL_CERT_DIR_HOOK_FILES = [
   "zz_pinokio_unset_ssl_cert_dir-win.ps1",
   "zz_pinokio_unset_ssl_cert_dir-win.sh",
 ]
+const WINDOWS_CONDA_ACTIVATE_RELATIVE_PATH = path.join(
+  "Lib",
+  "site-packages",
+  "conda",
+  "shell",
+  "condabin",
+  "_conda_activate.bat"
+)
+const WINDOWS_CONDA_ACTIVATE_PINOKIO_MARKER = ":PINOKIO_APPLY_CONDA_ENV"
+
+function windowsCondaActivateOriginalBlock(eol) {
+  return [
+    "    ) ELSE ENDLOCAL & (",
+    '        FOR /F "tokens=1,* delims==" %%A IN (%%T) DO (',
+    '            :: A, B = "key", "value"',
+    '            IF "%CONDA_DEBUG%" == "1" ECHO DEBUG: "%%A=%%B">&2',
+    '            IF "%%A"=="_CONDA_SCRIPT" (',
+    "                :: Script execution, fast exit if activation scripts fail",
+    '                CALL "%%B" || (',
+    '                    ECHO ERROR: Activation script "%%B" failed with code %ERRORLEVEL%.>&2',
+    '                    CALL :DELETE "%%T"',
+    '                    CALL :DELETE "%__conda_tmp%"',
+    "                    EXIT /B 4",
+    "                )",
+    '            ) ELSE IF "%%B"=="" (',
+    "                :: Unset variable",
+    '                SET "%%A="',
+    "            ) ELSE (",
+    "                :: Set variable",
+    '                SET "%%A=%%B"',
+    "            )",
+    "        )",
+    "        :: Clean up",
+    '        CALL :DELETE "%%T"',
+    '        CALL :DELETE "%__conda_tmp%"',
+    "        EXIT /B 0",
+    "    )",
+  ].join(eol)
+}
+
+function windowsCondaActivatePatchedBlock(eol) {
+  return [
+    '    ) ELSE ENDLOCAL & @CALL :PINOKIO_APPLY_CONDA_ENV "%%T" "%__conda_tmp%" & @GOTO :EOF',
+  ].join(eol)
+}
+
+function windowsCondaActivatePatchRoutines(eol) {
+  return [
+    ":PINOKIO_APPLY_CONDA_ENV",
+    '@FOR /F "tokens=1,* delims==" %%A IN (%~1) DO (',
+    '@IF "%CONDA_DEBUG%" == "1" ECHO DEBUG: "%%A=%%B">&2',
+    '@IF "%%A"=="_CONDA_SCRIPT" (',
+    '@CALL "%%B" || (',
+    '@ECHO ERROR: Activation script "%%B" failed with code %ERRORLEVEL%.>&2',
+    '@CALL :DELETE "%~1"',
+    '@CALL :DELETE "%~2"',
+    "@EXIT /B 4",
+    ")",
+    ') ELSE IF "%%B"=="" (',
+    '@SET "%%A="',
+    ") ELSE (",
+    '@SET "%%A=%%B"',
+    ")",
+    ")",
+    '@CALL :DELETE "%~1"',
+    '@CALL :DELETE "%~2"',
+    "@EXIT /B 0",
+    "",
+  ].join(eol)
+}
 
 class Conda {
   description = "Pinokio uses Conda to install various useful programs in an isolated manner."
@@ -161,6 +231,42 @@ class Conda {
       }
     }
   }
+  async ensureWindowsCondaActivateEchoPatch() {
+    if (this.kernel.platform !== "win32" || !(await this.hasCondaMeta())) {
+      return
+    }
+    const activatePath = this.kernel.bin.path(CONDA_ROOT_DIR, WINDOWS_CONDA_ACTIVATE_RELATIVE_PATH)
+    let content
+    try {
+      content = await fs.promises.readFile(activatePath, "utf8")
+    } catch (error) {
+      if (error && error.code === "ENOENT") {
+        return
+      }
+      throw error
+    }
+    if (content.includes(WINDOWS_CONDA_ACTIVATE_PINOKIO_MARKER)) {
+      return
+    }
+    const eol = content.includes("\r\n") ? "\r\n" : "\n"
+    const originalBlock = windowsCondaActivateOriginalBlock(eol)
+    if (!content.includes(originalBlock)) {
+      console.warn("Could not patch Conda CMD activation echo leak; unexpected _conda_activate.bat")
+      return
+    }
+    const routineAnchor = `${eol}:: Routine to delete a temp file if CONDA_DEBUG is not set`
+    if (!content.includes(routineAnchor)) {
+      console.warn("Could not patch Conda CMD activation echo leak; missing _conda_activate.bat routine anchor")
+      return
+    }
+    const patched = content
+      .replace(originalBlock, windowsCondaActivatePatchedBlock(eol))
+      .replace(
+        routineAnchor,
+        `${eol}${windowsCondaActivatePatchRoutines(eol)}:: Routine to delete a temp file if CONDA_DEBUG is not set`
+      )
+    await fs.promises.writeFile(activatePath, patched)
+  }
   async init() {
     if (this.kernel.homedir) {
         console.log("condarc init")
@@ -183,6 +289,7 @@ report_errors: false`)
         await this.ensureCompatibilityAlias()
       }
       await this.ensureWindowsOpenSslHooks()
+      await this.ensureWindowsCondaActivateEchoPatch()
     }
   }
   async check() {
@@ -205,8 +312,7 @@ report_errors: false`)
           conda_versions[name] = version
           conda_builds[name] = build
           if (name === "conda") {
-            const coerced = semver.coerce(version)
-            conda_check.conda = coerced && semver.eq(coerced, CONDA_PIN_VERSION)
+            conda_check.conda = true
           }
           // check conda-libmamba-solver is up to date
           // sometimes it just fails silently so need to check
@@ -309,7 +415,6 @@ report_errors: false`)
 
     let condaPackages = [
       this.kernel.platform === "win32" ? `"${WINDOWS_PYTHON_SSL_FIX_SPEC}"` : `"${PYTHON_INSTALL_SPEC}"`,
-      `"conda=${CONDA_PIN_VERSION}"`,
       `"conda-libmamba-solver>=25.4.0"`,
     ]
 
@@ -333,6 +438,7 @@ report_errors: false`)
       )
     }
     await this.ensureWindowsOpenSslHooks()
+    await this.ensureWindowsCondaActivateEchoPatch()
     await this.ensureCompatibilityAlias()
     ondata({ raw: `Install finished\r\n` })
     await this.kernel.bin.rm(installer, ondata)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "7.5.32",
+  "version": "7.5.34",
   "description": "",
   "main": "index.js",
   "scripts": {

package/test/conda-bin.test.js

@@ -7,7 +7,6 @@ const test = require('node:test')
 
 const Conda = require('../kernel/bin/conda')
 const {
-  CONDA_PIN_VERSION,
   PYTHON_INSTALL_SPEC,
   WINDOWS_PYTHON_SSL_FIX_SPEC,
   isExpectedPythonPinned,
@@ -43,7 +42,7 @@ async function writeCondaMeta(root, name, version, build = 'py_0') {
 }
 
 async function writeHealthyCondaMeta(root, platform = 'win32') {
-  await writeCondaMeta(root, 'conda', CONDA_PIN_VERSION, 'py310')
+  await writeCondaMeta(root, 'conda', '26.3.2', 'py310')
   await writeCondaMeta(root, 'conda-libmamba-solver', '25.4.0', 'pyhd3eb1b0_0')
   await writeCondaMeta(root, 'python', '3.10.20', platform === 'win32' ? 'h4de0772_1_cpython' : 'cpython')
 }
@@ -126,6 +125,58 @@ const EXPECTED_WINDOWS_OPENSSL_HOOKS = {
   ].join('\n'),
 }
 
+const WINDOWS_CONDA_ACTIVATE_PATH = path.join(
+  'bin',
+  'miniforge',
+  'Lib',
+  'site-packages',
+  'conda',
+  'shell',
+  'condabin',
+  '_conda_activate.bat'
+)
+const WINDOWS_CONDA_ACTIVATE_ORIGINAL_BLOCK = [
+  '    ) ELSE ENDLOCAL & (',
+  '        FOR /F "tokens=1,* delims==" %%A IN (%%T) DO (',
+  '            :: A, B = "key", "value"',
+  '            IF "%CONDA_DEBUG%" == "1" ECHO DEBUG: "%%A=%%B">&2',
+  '            IF "%%A"=="_CONDA_SCRIPT" (',
+  '                :: Script execution, fast exit if activation scripts fail',
+  '                CALL "%%B" || (',
+  '                    ECHO ERROR: Activation script "%%B" failed with code %ERRORLEVEL%.>&2',
+  '                    CALL :DELETE "%%T"',
+  '                    CALL :DELETE "%__conda_tmp%"',
+  '                    EXIT /B 4',
+  '                )',
+  '            ) ELSE IF "%%B"=="" (',
+  '                :: Unset variable',
+  '                SET "%%A="',
+  '            ) ELSE (',
+  '                :: Set variable',
+  '                SET "%%A=%%B"',
+  '            )',
+  '        )',
+  '        :: Clean up',
+  '        CALL :DELETE "%%T"',
+  '        CALL :DELETE "%__conda_tmp%"',
+  '        EXIT /B 0',
+  '    )',
+].join('\r\n')
+const WINDOWS_CONDA_ACTIVATE_SCRIPT = [
+  '@ECHO OFF',
+  'SETLOCAL',
+  'FOR /F "delims=" %%T IN (%__conda_tmp%) DO (',
+  '    IF NOT EXIST "%%T" (',
+  '        ENDLOCAL & EXIT /B 3',
+  WINDOWS_CONDA_ACTIVATE_ORIGINAL_BLOCK,
+  ')',
+  '',
+  ':: Routine to delete a temp file if CONDA_DEBUG is not set',
+  ':DELETE',
+  'GOTO :EOF',
+  '',
+].join('\r\n')
+
 async function seedWindowsOpenSslHooks(root, condaRootName) {
   const condaHookRoot = path.join(root, 'bin', condaRootName, 'etc', 'conda')
   for (const hookRelativePath of Object.keys(EXPECTED_WINDOWS_OPENSSL_HOOKS)) {
@@ -144,6 +195,13 @@ async function seedWindowsOpenSslHooks(root, condaRootName) {
   }
 }
 
+async function seedWindowsCondaActivateScript(root, content = WINDOWS_CONDA_ACTIVATE_SCRIPT) {
+  const activatePath = path.join(root, WINDOWS_CONDA_ACTIVATE_PATH)
+  await fs.mkdir(path.dirname(activatePath), { recursive: true })
+  await fs.writeFile(activatePath, content)
+  return activatePath
+}
+
 async function assertWindowsOpenSslHooksPatched(root, condaRootName) {
   const condaHookRoot = path.join(root, 'bin', condaRootName, 'etc', 'conda')
   for (const [hookRelativePath, expectedContent] of Object.entries(EXPECTED_WINDOWS_OPENSSL_HOOKS)) {
@@ -204,8 +262,52 @@ test('Conda init patches Windows OpenSSL hooks for legacy Miniconda roots', asyn
   await assertWindowsOpenSslHooksPatched(root, 'miniconda')
 })
 
+test('Conda init patches Windows CMD activation echo leak idempotently', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-cmd-activate-patch-'))
+  await fs.mkdir(path.join(root, 'bin', 'miniforge', 'conda-meta'), { recursive: true })
+  const activatePath = await seedWindowsCondaActivateScript(root)
+  const conda = createConda(createKernel(root))
+
+  await conda.init()
+  const patched = await fs.readFile(activatePath, 'utf8')
+  await conda.init()
+
+  assert.equal(await fs.readFile(activatePath, 'utf8'), patched)
+  assert.equal(patched.includes(WINDOWS_CONDA_ACTIVATE_ORIGINAL_BLOCK), false)
+  assert.match(patched, /ENDLOCAL & @CALL :PINOKIO_APPLY_CONDA_ENV "%%T" "%__conda_tmp%" & @GOTO :EOF/)
+  assert.match(patched, /:PINOKIO_APPLY_CONDA_ENV/)
+  assert.match(patched, /@CALL "%%B" \|\| \(/)
+  assert.match(patched, /:: Routine to delete a temp file if CONDA_DEBUG is not set/)
+})
+
+test('Conda init leaves unexpected Windows CMD activation script unchanged', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-cmd-activate-unexpected-'))
+  await fs.mkdir(path.join(root, 'bin', 'miniforge', 'conda-meta'), { recursive: true })
+  const unexpected = '@ECHO OFF\r\nREM unexpected upstream script\r\n'
+  const activatePath = await seedWindowsCondaActivateScript(root, unexpected)
+  const conda = createConda(createKernel(root))
+
+  await conda.init()
+
+  assert.equal(await fs.readFile(activatePath, 'utf8'), unexpected)
+})
+
+test('Conda init leaves Windows CMD activation script unchanged when patch anchor is missing', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-cmd-activate-missing-anchor-'))
+  await fs.mkdir(path.join(root, 'bin', 'miniforge', 'conda-meta'), { recursive: true })
+  const missingAnchor = WINDOWS_CONDA_ACTIVATE_SCRIPT.replace(
+    '\r\n:: Routine to delete a temp file if CONDA_DEBUG is not set',
+    '\r\n:: unexpected routine header'
+  )
+  const activatePath = await seedWindowsCondaActivateScript(root, missingAnchor)
+  const conda = createConda(createKernel(root))
+
+  await conda.init()
+
+  assert.equal(await fs.readFile(activatePath, 'utf8'), missingAnchor)
+})
+
 test('Conda pins Python 3.10.20 consistently across platforms', async () => {
-  assert.equal(CONDA_PIN_VERSION, '26.5.2')
   assert.equal(PYTHON_INSTALL_SPEC, 'python=3.10.20')
   assert.equal(WINDOWS_PYTHON_SSL_FIX_SPEC, 'python=3.10.20=*_1_cpython')
 
@@ -239,7 +341,7 @@ test('Conda install requests the Python 3.10.20 pin on macOS/Linux', async () =>
   assert.ok(condaInstall)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "python=3.10.20" "conda=26.5.2" "conda-libmamba-solver>=25.4.0"'
+    'conda install -y --override-channels -c conda-forge "python=3.10.20" "conda-libmamba-solver>=25.4.0"'
   )
 })
 
@@ -247,6 +349,7 @@ test('Conda install keeps the Windows Python 3.10.20 SSL-fixed build pin', async
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-python-pin-win32-'))
   const kernel = createKernel(root, 'win32')
   const calls = []
+  let activatePath
 
   kernel.bin.mods = []
   kernel.bin.download = async () => {}
@@ -257,6 +360,7 @@ test('Conda install keeps the Windows Python 3.10.20 SSL-fixed build pin', async
       const miniforge = path.join(root, 'bin', 'miniforge')
       await fs.mkdir(path.join(miniforge, 'conda-meta'), { recursive: true })
       await fs.writeFile(path.join(miniforge, 'python.exe'), 'fake python\n')
+      activatePath = await seedWindowsCondaActivateScript(root)
     }
   }
 
@@ -267,8 +371,9 @@ test('Conda install keeps the Windows Python 3.10.20 SSL-fixed build pin', async
   assert.ok(condaInstall)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "python=3.10.20=*_1_cpython" "conda=26.5.2" "conda-libmamba-solver>=25.4.0"'
+    'conda install -y --override-channels -c conda-forge "python=3.10.20=*_1_cpython" "conda-libmamba-solver>=25.4.0"'
   )
+  assert.match(await fs.readFile(activatePath, 'utf8'), /:PINOKIO_APPLY_CONDA_ENV/)
 })
 
 test('Conda install replaces legacy miniconda with a compatibility alias to miniforge', async () => {
@@ -341,16 +446,6 @@ test('Conda check accepts a runnable managed Windows conda executable', async ()
   assert.equal(await createConda(createKernel(root, 'win32')).check(), true)
 })
 
-test('Conda check rejects runnable installs with the wrong Conda version', async () => {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-smoke-wrong-version-'))
-  await writeCondaMeta(root, 'conda', '26.3.2', 'py310')
-  await writeCondaMeta(root, 'conda-libmamba-solver', '25.4.0', 'pyhd3eb1b0_0')
-  await writeCondaMeta(root, 'python', '3.10.20', 'h4de0772_1_cpython')
-  await writeFakeManagedConda(root, 'win32')
-
-  assert.equal(await createConda(createKernel(root, 'win32')).check(), false)
-})
-
 test('Conda install keeps the old runtime when the replacement installer download fails', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-download-fails-'))
   const miniconda = await createLegacyMiniconda(root)