pinokiod 8.0.1 → 8.0.2

package/kernel/bin/conda-pins.js

@@ -1,6 +1,7 @@
 const semver = require('semver')
 
 const CONDA_PIN_VERSION = "26.3.2"
+const CONDA_RUNTIME_MARKER = ".pinokio-runtime-v1"
 const PYTHON_PIN_VERSION = "3.10.20"
 const PYTHON_INSTALL_SPEC = `python=${PYTHON_PIN_VERSION}`
 const WINDOWS_PYTHON_SSL_FIX_SPEC = `${PYTHON_INSTALL_SPEC}=*_1_cpython`
@@ -28,6 +29,7 @@ const isExpectedPythonPinned = (platform, version, build) => {
 
 module.exports = {
   CONDA_PIN_VERSION,
+  CONDA_RUNTIME_MARKER,
   PYTHON_INSTALL_SPEC,
   WINDOWS_PYTHON_SSL_FIX_SPEC,
   isExpectedPythonPinned,

package/kernel/bin/conda.js

@@ -1,10 +1,10 @@
 const fs = require('fs')
-const path = require('path')
 const { glob } = require('glob')
 const semver = require('semver')
 const { buildCondaListFromMeta, managedCondaRuns } = require('./conda-meta')
 const {
   CONDA_PIN_VERSION,
+  CONDA_RUNTIME_MARKER,
   PYTHON_INSTALL_SPEC,
   WINDOWS_PYTHON_SSL_FIX_SPEC,
   isExpectedPythonPinned,
@@ -14,61 +14,6 @@ const MINIFORGE_RELEASE = "26.3.2-3"
 const MINIFORGE_BASE_URL = `https://github.com/conda-forge/miniforge/releases/download/${MINIFORGE_RELEASE}`
 const CONDA_ROOT_DIR = "miniforge"
 const LEGACY_CONDA_ROOT_DIR = "miniconda"
-const WINDOWS_OPENSSL_HOOKS = {
-  activate: {
-    "openssl_activate-win.bat": [
-      "@echo off",
-      'if "%SSL_CERT_FILE%"=="" (',
-      '    set "SSL_CERT_FILE=%CONDA_PREFIX%\\Library\\ssl\\cacert.pem"',
-      '    set "__CONDA_OPENSSL_CERT_FILE_SET=1"',
-      ")",
-      "",
-    ].join("\r\n"),
-    "openssl_activate-win.ps1": [
-      "if (-not $Env:SSL_CERT_FILE) {",
-      '    $Env:SSL_CERT_FILE = "$Env:CONDA_PREFIX\\Library\\ssl\\cacert.pem"',
-      '    $Env:__CONDA_OPENSSL_CERT_FILE_SET = "1"',
-      "}",
-      "",
-    ].join("\r\n"),
-    "openssl_activate-win.sh": [
-      'if [[ "${SSL_CERT_FILE:-}" == "" ]]; then',
-      '    export SSL_CERT_FILE="${CONDA_PREFIX}\\\\Library\\\\ssl\\\\cacert.pem"',
-      '    export __CONDA_OPENSSL_CERT_FILE_SET="1"',
-      "fi",
-      "",
-    ].join("\n"),
-  },
-  deactivate: {
-    "openssl_deactivate-win.bat": [
-      "@echo off",
-      'if "%__CONDA_OPENSSL_CERT_FILE_SET%" == "1" (',
-      "    set SSL_CERT_FILE=",
-      "    set __CONDA_OPENSSL_CERT_FILE_SET=",
-      ")",
-      "",
-    ].join("\r\n"),
-    "openssl_deactivate-win.ps1": [
-      'if ($Env:__CONDA_OPENSSL_CERT_FILE_SET -eq "1") {',
-      "    Remove-Item -Path Env:\\SSL_CERT_FILE",
-      "    Remove-Item -Path Env:\\__CONDA_OPENSSL_CERT_FILE_SET",
-      "}",
-      "",
-    ].join("\r\n"),
-    "openssl_deactivate-win.sh": [
-      'if [[ "${__CONDA_OPENSSL_CERT_FILE_SET:-}" == "1" ]]; then',
-      "    unset SSL_CERT_FILE",
-      "    unset __CONDA_OPENSSL_CERT_FILE_SET",
-      "fi",
-      "",
-    ].join("\n"),
-  },
-}
-const LEGACY_SSL_CERT_DIR_HOOK_FILES = [
-  "zz_pinokio_unset_ssl_cert_dir-win.bat",
-  "zz_pinokio_unset_ssl_cert_dir-win.ps1",
-  "zz_pinokio_unset_ssl_cert_dir-win.sh",
-]
 
 class Conda {
   description = "Pinokio uses Conda to install various useful programs in an isolated manner."
@@ -103,6 +48,9 @@ class Conda {
   async hasCondaMeta() {
     return await this.kernel.exists(`bin/${CONDA_ROOT_DIR}/conda-meta`)
   }
+  async hasRuntimeMarker() {
+    return await this.kernel.exists(`bin/${CONDA_ROOT_DIR}/${CONDA_RUNTIME_MARKER}`)
+  }
   env() {
     let base = {
       CONDA_PREFIX: this.kernel.bin.path(CONDA_ROOT_DIR),
@@ -124,43 +72,6 @@ class Conda {
     }
     return base
   }
-  async ensureWindowsOpenSslHooks() {
-    if (this.kernel.platform !== "win32") {
-      return
-    }
-    const condaRootDirs = []
-    for (const rootDir of [CONDA_ROOT_DIR, LEGACY_CONDA_ROOT_DIR]) {
-      if (await this.kernel.exists(`bin/${rootDir}/conda-meta`)) {
-        condaRootDirs.push(rootDir)
-      }
-    }
-    if (condaRootDirs.length === 0) {
-      return
-    }
-    for (const rootDir of condaRootDirs) {
-      const activateDir = this.kernel.bin.path(`${rootDir}/etc/conda/activate.d`)
-      const deactivateDir = this.kernel.bin.path(`${rootDir}/etc/conda/deactivate.d`)
-      for (const hookDir of [activateDir, deactivateDir]) {
-        for (const filename of LEGACY_SSL_CERT_DIR_HOOK_FILES) {
-          await fs.promises.rm(path.resolve(hookDir, filename), { force: true }).catch(() => {})
-        }
-      }
-      for (const [filename, content] of Object.entries(WINDOWS_OPENSSL_HOOKS.activate)) {
-        const hookPath = path.resolve(activateDir, filename)
-        const exists = await fs.promises.access(hookPath).then(() => true).catch(() => false)
-        if (exists) {
-          await fs.promises.writeFile(hookPath, content)
-        }
-      }
-      for (const [filename, content] of Object.entries(WINDOWS_OPENSSL_HOOKS.deactivate)) {
-        const hookPath = path.resolve(deactivateDir, filename)
-        const exists = await fs.promises.access(hookPath).then(() => true).catch(() => false)
-        if (exists) {
-          await fs.promises.writeFile(hookPath, content)
-        }
-      }
-    }
-  }
   async init() {
     if (this.kernel.homedir) {
         console.log("condarc init")
@@ -182,10 +93,12 @@ report_errors: false`)
         await fs.promises.writeFile(this.kernel.path(`bin/${CONDA_ROOT_DIR}/conda-meta/pinned`), this.pinnedPackages())
         await this.ensureCompatibilityAlias()
       }
-      await this.ensureWindowsOpenSslHooks()
     }
   }
   async check() {
+    if (!(await this.hasRuntimeMarker())) {
+      return false
+    }
     let res = await buildCondaListFromMeta(this.kernel.bin.path(CONDA_ROOT_DIR))
 
     let lines = res.response.split(/[\r\n]+/)
@@ -330,10 +243,10 @@ report_errors: false`)
         this.kernel.bin.path(CONDA_ROOT_DIR, "python3.exe"),
       )
     }
-    await this.ensureWindowsOpenSslHooks()
     await this.ensureCompatibilityAlias()
-    ondata({ raw: `Install finished\r\n` })
     await this.kernel.bin.rm(installer, ondata)
+    await fs.promises.writeFile(this.kernel.bin.path(CONDA_ROOT_DIR, CONDA_RUNTIME_MARKER), "")
+    ondata({ raw: `Install finished\r\n` })
   }
   async removeInstallPath(target) {
     try {

package/kernel/bin/index.js

@@ -23,6 +23,7 @@ const Cuda = require("./cuda")
 const Torch = require("./torch")
 const { buildCondaListFromMeta, managedCondaRuns } = require('./conda-meta')
 const {
+  CONDA_RUNTIME_MARKER,
   isExpectedPythonPinned,
 } = require('./conda-pins')
 const { glob } = require('glob')
@@ -349,6 +350,10 @@ class Bin {
     let conda_builds = {}
     this.correct_conda = false
 
+    const runtimeMarkerExists = await fs.promises.access(
+      this.kernel.bin.path("miniforge", CONDA_RUNTIME_MARKER)
+    ).then(() => true).catch(() => false)
+
     //////////////////////////////////////////////////////////////////
     // exception handling
     // if importlib_metadata || uvicorn || fastapi exist in the base environment, this.correct_conda = false
@@ -375,7 +380,7 @@ class Bin {
 
     let to_reset_exists = false
 
-    if (to_reset_exists) {
+    if (!runtimeMarkerExists || to_reset_exists) {
       this.correct_conda = false
     } else {
       let res = await buildCondaListFromMeta(this.kernel.bin.path("miniforge"))
@@ -448,9 +453,6 @@ class Bin {
           break 
         }
       }
-      if (this.mod && this.mod.conda && this.mod.conda.ensureWindowsOpenSslHooks) {
-        await this.mod.conda.ensureWindowsOpenSslHooks()
-      }
     }
 
     if (this.platform === "darwin") {

package/kernel/shell.js

@@ -294,6 +294,14 @@ class Shell {
     setDefaultEnvValue(this.env, "HF_TOKEN_PATH", path.resolve(this.kernel.homedir, "cache", "HF_AUTH", "token"))
 
     if (this.platform === "win32") {
+      const managedSslDir = path.resolve(this.kernel.homedir, "bin", "miniforge", "Library", "ssl")
+      const managedCertFile = path.resolve(managedSslDir, "cacert.pem")
+      const managedCertFileExists = await fs.promises.access(managedCertFile).then(() => true).catch(() => false)
+      if (managedCertFileExists) {
+        setDefaultEnvValue(this.env, "SSL_CERT_FILE", managedCertFile)
+        setDefaultEnvValue(this.env, "SSL_CERT_DIR", managedSslDir)
+      }
+
       // Hugging Face file symlinks regularly fail on non-admin Windows setups.
       // Default to no-symlink cache mode unless the user/app explicitly overrides it.
       setDefaultEnvValue(this.env, "HF_HUB_DISABLE_SYMLINKS", "1")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.0.1",
+  "version": "8.0.2",
   "description": "",
   "main": "index.js",
   "scripts": {

package/test/conda-bin.test.js

@@ -5,8 +5,11 @@ const os = require('node:os')
 const path = require('node:path')
 const test = require('node:test')
 
+const Bin = require('../kernel/bin')
 const Conda = require('../kernel/bin/conda')
 const {
+  CONDA_PIN_VERSION,
+  CONDA_RUNTIME_MARKER,
   PYTHON_INSTALL_SPEC,
   WINDOWS_PYTHON_SSL_FIX_SPEC,
   isExpectedPythonPinned,
@@ -42,11 +45,18 @@ async function writeCondaMeta(root, name, version, build = 'py_0') {
 }
 
 async function writeHealthyCondaMeta(root, platform = 'win32') {
-  await writeCondaMeta(root, 'conda', '26.3.2', 'py310')
+  await writeCondaMeta(root, 'conda', CONDA_PIN_VERSION, 'py310')
   await writeCondaMeta(root, 'conda-libmamba-solver', '25.4.0', 'pyhd3eb1b0_0')
   await writeCondaMeta(root, 'python', '3.10.20', platform === 'win32' ? 'h4de0772_1_cpython' : 'cpython')
 }
 
+async function writeRuntimeMarker(root) {
+  const marker = path.join(root, 'bin', 'miniforge', CONDA_RUNTIME_MARKER)
+  await fs.mkdir(path.dirname(marker), { recursive: true })
+  await fs.writeFile(marker, '')
+  return marker
+}
+
 async function writeFakeManagedConda(root, platform = 'win32') {
   const condaPath = platform === 'win32'
     ? path.join(root, 'bin', 'miniforge', 'Scripts', 'conda.exe')
@@ -78,86 +88,17 @@ function createConda(kernel) {
   return conda
 }
 
-const EXPECTED_WINDOWS_OPENSSL_HOOKS = {
-  [path.join('activate.d', 'openssl_activate-win.bat')]: [
-    '@echo off',
-    'if "%SSL_CERT_FILE%"=="" (',
-    '    set "SSL_CERT_FILE=%CONDA_PREFIX%\\Library\\ssl\\cacert.pem"',
-    '    set "__CONDA_OPENSSL_CERT_FILE_SET=1"',
-    ')',
-    '',
-  ].join('\r\n'),
-  [path.join('activate.d', 'openssl_activate-win.ps1')]: [
-    'if (-not $Env:SSL_CERT_FILE) {',
-    '    $Env:SSL_CERT_FILE = "$Env:CONDA_PREFIX\\Library\\ssl\\cacert.pem"',
-    '    $Env:__CONDA_OPENSSL_CERT_FILE_SET = "1"',
-    '}',
-    '',
-  ].join('\r\n'),
-  [path.join('activate.d', 'openssl_activate-win.sh')]: [
-    'if [[ "${SSL_CERT_FILE:-}" == "" ]]; then',
-    '    export SSL_CERT_FILE="${CONDA_PREFIX}\\\\Library\\\\ssl\\\\cacert.pem"',
-    '    export __CONDA_OPENSSL_CERT_FILE_SET="1"',
-    'fi',
-    '',
-  ].join('\n'),
-  [path.join('deactivate.d', 'openssl_deactivate-win.bat')]: [
-    '@echo off',
-    'if "%__CONDA_OPENSSL_CERT_FILE_SET%" == "1" (',
-    '    set SSL_CERT_FILE=',
-    '    set __CONDA_OPENSSL_CERT_FILE_SET=',
-    ')',
-    '',
-  ].join('\r\n'),
-  [path.join('deactivate.d', 'openssl_deactivate-win.ps1')]: [
-    'if ($Env:__CONDA_OPENSSL_CERT_FILE_SET -eq "1") {',
-    '    Remove-Item -Path Env:\\SSL_CERT_FILE',
-    '    Remove-Item -Path Env:\\__CONDA_OPENSSL_CERT_FILE_SET',
-    '}',
-    '',
-  ].join('\r\n'),
-  [path.join('deactivate.d', 'openssl_deactivate-win.sh')]: [
-    'if [[ "${__CONDA_OPENSSL_CERT_FILE_SET:-}" == "1" ]]; then',
-    '    unset SSL_CERT_FILE',
-    '    unset __CONDA_OPENSSL_CERT_FILE_SET',
-    'fi',
-    '',
-  ].join('\n'),
-}
-
-async function seedWindowsOpenSslHooks(root, condaRootName) {
-  const condaHookRoot = path.join(root, 'bin', condaRootName, 'etc', 'conda')
-  for (const hookRelativePath of Object.keys(EXPECTED_WINDOWS_OPENSSL_HOOKS)) {
-    const hookPath = path.join(condaHookRoot, hookRelativePath)
-    await fs.mkdir(path.dirname(hookPath), { recursive: true })
-    await fs.writeFile(hookPath, 'upstream hook with SSL_CERT_DIR\n')
-  }
-  for (const hookDirName of ['activate.d', 'deactivate.d']) {
-    for (const filename of [
-      'zz_pinokio_unset_ssl_cert_dir-win.bat',
-      'zz_pinokio_unset_ssl_cert_dir-win.ps1',
-      'zz_pinokio_unset_ssl_cert_dir-win.sh',
-    ]) {
-      await fs.writeFile(path.join(condaHookRoot, hookDirName, filename), 'legacy hook\n')
-    }
-  }
-}
-
-async function assertWindowsOpenSslHooksPatched(root, condaRootName) {
-  const condaHookRoot = path.join(root, 'bin', condaRootName, 'etc', 'conda')
-  for (const [hookRelativePath, expectedContent] of Object.entries(EXPECTED_WINDOWS_OPENSSL_HOOKS)) {
-    const hookPath = path.join(condaHookRoot, hookRelativePath)
-    assert.equal(await fs.readFile(hookPath, 'utf8'), expectedContent)
-  }
-  for (const hookDirName of ['activate.d', 'deactivate.d']) {
-    for (const filename of [
-      'zz_pinokio_unset_ssl_cert_dir-win.bat',
-      'zz_pinokio_unset_ssl_cert_dir-win.ps1',
-      'zz_pinokio_unset_ssl_cert_dir-win.sh',
-    ]) {
-      assert.equal(await pathExists(path.join(condaHookRoot, hookDirName, filename)), false)
-    }
+function createBin(root, platform = 'win32') {
+  const kernel = {
+    homedir: root,
+    platform,
+    path: (...parts) => path.join(root, ...parts),
   }
+  const bin = new Bin(kernel)
+  bin.platform = platform
+  bin.installed = {}
+  kernel.bin = bin
+  return bin
 }
 
 test('Conda uses Miniforge assets and writes conda-forge-only config', async () => {
@@ -181,29 +122,9 @@ test('Conda uses Miniforge assets and writes conda-forge-only config', async ()
   assert.equal(await pathExists(path.join(root, 'bin', 'miniforge')), false)
 })
 
-test('Conda init patches Windows OpenSSL hooks and removes legacy SSL_CERT_DIR hooks', async () => {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-openssl-hooks-'))
-  await fs.mkdir(path.join(root, 'bin', 'miniforge', 'conda-meta'), { recursive: true })
-  await seedWindowsOpenSslHooks(root, 'miniforge')
-  const conda = createConda(createKernel(root))
-
-  await conda.init()
-
-  await assertWindowsOpenSslHooksPatched(root, 'miniforge')
-})
-
-test('Conda init patches Windows OpenSSL hooks for legacy Miniconda roots', async () => {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-legacy-openssl-hooks-'))
-  await fs.mkdir(path.join(root, 'bin', 'miniconda', 'conda-meta'), { recursive: true })
-  await seedWindowsOpenSslHooks(root, 'miniconda')
-  const conda = createConda(createKernel(root))
-
-  await conda.init()
-
-  await assertWindowsOpenSslHooksPatched(root, 'miniconda')
-})
-
-test('Conda pins Python 3.10.20 consistently across platforms', async () => {
+test('Conda pins the managed Conda and Python versions consistently', async () => {
+  assert.equal(CONDA_PIN_VERSION, '26.3.2')
+  assert.equal(CONDA_RUNTIME_MARKER, '.pinokio-runtime-v1')
   assert.equal(PYTHON_INSTALL_SPEC, 'python=3.10.20')
   assert.equal(WINDOWS_PYTHON_SSL_FIX_SPEC, 'python=3.10.20=*_1_cpython')
 
@@ -215,6 +136,48 @@ test('Conda pins Python 3.10.20 consistently across platforms', async () => {
   assert.equal(isExpectedPythonPinned('win32', '3.10.20', 'h4de0772_1_cpython'), true)
 })
 
+test('Conda init does not mark an existing runtime as rebuilt', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-marker-init-'))
+  await createMiniforge(root)
+  await fs.mkdir(path.join(root, 'bin', 'miniforge', 'conda-meta'), { recursive: true })
+
+  await createConda(createKernel(root, 'darwin')).init()
+
+  assert.equal(await pathExists(path.join(root, 'bin', 'miniforge', CONDA_RUNTIME_MARKER)), false)
+  assert.equal(
+    await fs.readFile(path.join(root, 'bin', 'miniforge', 'conda-meta', 'pinned'), 'utf8'),
+    'conda ==26.3.2'
+  )
+})
+
+test('Conda init leaves Windows OpenSSL activation hooks untouched', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-hooks-untouched-'))
+  const hookRoot = path.join(root, 'bin', 'miniforge', 'etc', 'conda')
+  const hookFiles = [
+    path.join('activate.d', 'openssl_activate-win.bat'),
+    path.join('activate.d', 'openssl_activate-win.ps1'),
+    path.join('activate.d', 'openssl_activate-win.sh'),
+    path.join('deactivate.d', 'openssl_deactivate-win.bat'),
+    path.join('deactivate.d', 'openssl_deactivate-win.ps1'),
+    path.join('deactivate.d', 'openssl_deactivate-win.sh'),
+  ]
+  await fs.mkdir(path.join(root, 'bin', 'miniforge', 'conda-meta'), { recursive: true })
+  for (const relativePath of hookFiles) {
+    const hookPath = path.join(hookRoot, relativePath)
+    await fs.mkdir(path.dirname(hookPath), { recursive: true })
+    await fs.writeFile(hookPath, `upstream ${relativePath}\n`)
+  }
+
+  await createConda(createKernel(root, 'win32')).init()
+
+  for (const relativePath of hookFiles) {
+    assert.equal(
+      await fs.readFile(path.join(hookRoot, relativePath), 'utf8'),
+      `upstream ${relativePath}\n`
+    )
+  }
+})
+
 test('Conda install requests the Python 3.10.20 pin on macOS/Linux', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-python-pin-darwin-'))
   const kernel = createKernel(root, 'darwin')
@@ -239,6 +202,11 @@ test('Conda install requests the Python 3.10.20 pin on macOS/Linux', async () =>
     condaInstall.message[1],
     'conda install -y --override-channels -c conda-forge "python=3.10.20" "conda-libmamba-solver>=25.4.0"'
   )
+  assert.equal(
+    await fs.readFile(path.join(root, 'bin', 'miniforge', 'conda-meta', 'pinned'), 'utf8'),
+    'conda ==26.3.2'
+  )
+  assert.equal(await pathExists(path.join(root, 'bin', 'miniforge', CONDA_RUNTIME_MARKER)), true)
 })
 
 test('Conda install keeps the Windows Python 3.10.20 SSL-fixed build pin', async () => {
@@ -267,6 +235,40 @@ test('Conda install keeps the Windows Python 3.10.20 SSL-fixed build pin', async
     condaInstall.message[1],
     'conda install -y --override-channels -c conda-forge "python=3.10.20=*_1_cpython" "conda-libmamba-solver>=25.4.0"'
   )
+  assert.equal(await pathExists(path.join(root, 'bin', 'miniforge', CONDA_RUNTIME_MARKER)), true)
+})
+
+test('Conda install replaces the stale runtime and rebuilds declared Conda modules', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-full-reset-'))
+  const staleRoot = await createMiniforge(root)
+  const staleMarker = path.join(staleRoot, 'stale-runtime.txt')
+  await fs.writeFile(staleMarker, 'remove me\n')
+  const kernel = createKernel(root, 'darwin')
+  const calls = []
+
+  kernel.bin.mods = [
+    { name: 'uv', mod: { cmd: () => 'uv=0.11.23' } },
+    { name: 'node', mod: { cmd: () => 'nodejs=22.21.1 pnpm' } },
+  ]
+  kernel.bin.download = async () => {}
+  kernel.bin.rm = async () => {}
+  kernel.bin.exec = async (payload) => {
+    calls.push(payload)
+    if (payload && payload.conda && payload.conda.skip) {
+      await fs.mkdir(path.join(root, 'bin', 'miniforge', 'conda-meta'), { recursive: true })
+    }
+  }
+
+  await createConda(kernel)._install({ dependencies: ['uv', 'node'] }, () => {})
+
+  assert.equal(await pathExists(staleMarker), false)
+  const condaInstall = calls.find((call) => Array.isArray(call.message))
+  assert.ok(condaInstall)
+  assert.equal(
+    condaInstall.message[1],
+    'conda install -y --override-channels -c conda-forge "python=3.10.20" "conda-libmamba-solver>=25.4.0" uv=0.11.23 nodejs=22.21.1 pnpm'
+  )
+  assert.equal(await pathExists(path.join(root, 'bin', 'miniforge', CONDA_RUNTIME_MARKER)), true)
 })
 
 test('Conda install replaces legacy miniconda with a compatibility alias to miniforge', async () => {
@@ -327,6 +329,15 @@ test('Conda installed stays false when metadata check already marked Conda inval
 test('Conda check rejects metadata-only Windows installs', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-smoke-missing-'))
   await writeHealthyCondaMeta(root, 'win32')
+  await writeRuntimeMarker(root)
+
+  assert.equal(await createConda(createKernel(root, 'win32')).check(), false)
+})
+
+test('Conda check rejects an otherwise healthy runtime without the runtime marker', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-marker-stale-'))
+  await writeHealthyCondaMeta(root, 'win32')
+  await writeFakeManagedConda(root, 'win32')
 
   assert.equal(await createConda(createKernel(root, 'win32')).check(), false)
 })
@@ -335,13 +346,31 @@ test('Conda check accepts a runnable managed Windows conda executable', async ()
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-smoke-runnable-'))
   await writeHealthyCondaMeta(root, 'win32')
   await writeFakeManagedConda(root, 'win32')
+  await writeRuntimeMarker(root)
 
   assert.equal(await createConda(createKernel(root, 'win32')).check(), true)
 })
 
+test('Bin readiness rejects a runtime without the marker and accepts it once marked', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-bin-conda-marker-'))
+  await writeHealthyCondaMeta(root, 'win32')
+  await writeFakeManagedConda(root, 'win32')
+  const bin = createBin(root, 'win32')
+
+  await bin.tryList()
+  assert.equal(bin.correct_conda, false)
+
+  await writeRuntimeMarker(root)
+
+  await bin.tryList()
+  assert.equal(bin.correct_conda, true)
+})
+
 test('Conda install keeps the old runtime when the replacement installer download fails', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-download-fails-'))
-  const miniconda = await createLegacyMiniconda(root)
+  const miniforge = await createMiniforge(root)
+  const oldRuntimeFile = path.join(miniforge, 'old-runtime.txt')
+  await fs.writeFile(oldRuntimeFile, 'keep me\n')
   const kernel = createKernel(root)
 
   kernel.bin.download = async () => {
@@ -352,8 +381,31 @@ test('Conda install keeps the old runtime when the replacement installer downloa
     createConda(kernel)._install({ dependencies: [] }, () => {}),
     /download failed/
   )
-  assert.equal(await pathExists(miniconda), true)
-  assert.equal(await pathExists(path.join(root, 'bin', 'miniforge')), false)
+  assert.equal(await pathExists(oldRuntimeFile), true)
+  assert.equal(await pathExists(path.join(miniforge, CONDA_RUNTIME_MARKER)), false)
+})
+
+test('Conda install leaves the runtime unmarked when bootstrap fails after replacement', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-bootstrap-fails-'))
+  await createMiniforge(root)
+  const kernel = createKernel(root, 'darwin')
+
+  kernel.bin.mods = []
+  kernel.bin.download = async () => {}
+  kernel.bin.rm = async () => {}
+  kernel.bin.exec = async (payload) => {
+    if (payload && payload.conda && payload.conda.skip) {
+      await fs.mkdir(path.join(root, 'bin', 'miniforge', 'conda-meta'), { recursive: true })
+      return
+    }
+    throw new Error('bootstrap failed')
+  }
+
+  await assert.rejects(
+    createConda(kernel)._install({ dependencies: [] }, () => {}),
+    /bootstrap failed/
+  )
+  assert.equal(await pathExists(path.join(root, 'bin', 'miniforge', CONDA_RUNTIME_MARKER)), false)
 })
 
 test('Conda install reports manual recovery when the old runtime cannot be removed', async () => {

package/test/shell-run-template.test.js

@@ -197,6 +197,48 @@ test('Shell.init_env keeps Windows Hugging Face symlink defaults scoped to win32
   assert.equal(winShell.env.HF_HUB_DISABLE_SYMLINKS_WARNING, '1')
 })
 
+test('Shell.init_env gives Windows uv a valid managed certificate directory without overriding apps', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-shell-ssl-win-'))
+  const managedSslDir = path.join(root, 'bin', 'miniforge', 'Library', 'ssl')
+  const managedCertFile = path.join(managedSslDir, 'cacert.pem')
+  await fs.mkdir(path.join(root, 'api'), { recursive: true })
+  await fs.mkdir(managedSslDir, { recursive: true })
+  await fs.writeFile(path.join(root, 'ENVIRONMENT'), 'PINOKIO_TEST_ENV=1\n')
+  await fs.writeFile(managedCertFile, 'test certificate bundle\n')
+
+  const defaultShell = createShell(createKernel(root))
+  defaultShell.platform = 'win32'
+  await defaultShell.init_env({
+    path: process.cwd(),
+    env: {}
+  })
+  assert.equal(defaultShell.env.SSL_CERT_FILE, managedCertFile)
+  assert.equal(defaultShell.env.SSL_CERT_DIR, managedSslDir)
+
+  const customCertFile = path.join(root, 'custom', 'certs.pem')
+  const customCertDir = path.join(root, 'custom', 'certs')
+  const overrideShell = createShell(createKernel(root))
+  overrideShell.platform = 'win32'
+  await overrideShell.init_env({
+    path: process.cwd(),
+    env: {
+      SSL_CERT_FILE: customCertFile,
+      SSL_CERT_DIR: customCertDir
+    }
+  })
+  assert.equal(overrideShell.env.SSL_CERT_FILE, customCertFile)
+  assert.equal(overrideShell.env.SSL_CERT_DIR, customCertDir)
+
+  const darwinShell = createShell(createKernel(root))
+  darwinShell.platform = 'darwin'
+  await darwinShell.init_env({
+    path: process.cwd(),
+    env: {}
+  })
+  assert.equal(darwinShell.env.SSL_CERT_FILE, undefined)
+  assert.equal(darwinShell.env.SSL_CERT_DIR, undefined)
+})
+
 test('redactEnvArgs summarizes protected argv env values', () => {
   const redacted = ShellRunTemplate.redactEnvArgs({
     PINOKIO_ARG_0: 'line one\nline two',