pinokiod 8.0.1 → 8.0.3

package/kernel/bin/conda-pins.js

@@ -1,10 +1,12 @@
 const semver = require('semver')
 
-const CONDA_PIN_VERSION = "26.3.2"
+const CONDA_PIN_VERSION = "26.5.3"
 const PYTHON_PIN_VERSION = "3.10.20"
 const PYTHON_INSTALL_SPEC = `python=${PYTHON_PIN_VERSION}`
 const WINDOWS_PYTHON_SSL_FIX_SPEC = `${PYTHON_INSTALL_SPEC}=*_1_cpython`
 
+const isExpectedCondaPinned = (version) => String(version) === CONDA_PIN_VERSION
+
 const condaBuildNumber = (build) => {
   const chunks = String(build || "").split("_").reverse()
   const buildNumber = chunks.find((chunk) => /^\d+$/.test(chunk))
@@ -30,5 +32,6 @@ module.exports = {
   CONDA_PIN_VERSION,
   PYTHON_INSTALL_SPEC,
   WINDOWS_PYTHON_SSL_FIX_SPEC,
+  isExpectedCondaPinned,
   isExpectedPythonPinned,
 }

package/kernel/bin/conda.js

@@ -1,5 +1,4 @@
 const fs = require('fs')
-const path = require('path')
 const { glob } = require('glob')
 const semver = require('semver')
 const { buildCondaListFromMeta, managedCondaRuns } = require('./conda-meta')
@@ -7,6 +6,7 @@ const {
   CONDA_PIN_VERSION,
   PYTHON_INSTALL_SPEC,
   WINDOWS_PYTHON_SSL_FIX_SPEC,
+  isExpectedCondaPinned,
   isExpectedPythonPinned,
 } = require('./conda-pins')
 
@@ -14,61 +14,6 @@ const MINIFORGE_RELEASE = "26.3.2-3"
 const MINIFORGE_BASE_URL = `https://github.com/conda-forge/miniforge/releases/download/${MINIFORGE_RELEASE}`
 const CONDA_ROOT_DIR = "miniforge"
 const LEGACY_CONDA_ROOT_DIR = "miniconda"
-const WINDOWS_OPENSSL_HOOKS = {
-  activate: {
-    "openssl_activate-win.bat": [
-      "@echo off",
-      'if "%SSL_CERT_FILE%"=="" (',
-      '    set "SSL_CERT_FILE=%CONDA_PREFIX%\\Library\\ssl\\cacert.pem"',
-      '    set "__CONDA_OPENSSL_CERT_FILE_SET=1"',
-      ")",
-      "",
-    ].join("\r\n"),
-    "openssl_activate-win.ps1": [
-      "if (-not $Env:SSL_CERT_FILE) {",
-      '    $Env:SSL_CERT_FILE = "$Env:CONDA_PREFIX\\Library\\ssl\\cacert.pem"',
-      '    $Env:__CONDA_OPENSSL_CERT_FILE_SET = "1"',
-      "}",
-      "",
-    ].join("\r\n"),
-    "openssl_activate-win.sh": [
-      'if [[ "${SSL_CERT_FILE:-}" == "" ]]; then',
-      '    export SSL_CERT_FILE="${CONDA_PREFIX}\\\\Library\\\\ssl\\\\cacert.pem"',
-      '    export __CONDA_OPENSSL_CERT_FILE_SET="1"',
-      "fi",
-      "",
-    ].join("\n"),
-  },
-  deactivate: {
-    "openssl_deactivate-win.bat": [
-      "@echo off",
-      'if "%__CONDA_OPENSSL_CERT_FILE_SET%" == "1" (',
-      "    set SSL_CERT_FILE=",
-      "    set __CONDA_OPENSSL_CERT_FILE_SET=",
-      ")",
-      "",
-    ].join("\r\n"),
-    "openssl_deactivate-win.ps1": [
-      'if ($Env:__CONDA_OPENSSL_CERT_FILE_SET -eq "1") {',
-      "    Remove-Item -Path Env:\\SSL_CERT_FILE",
-      "    Remove-Item -Path Env:\\__CONDA_OPENSSL_CERT_FILE_SET",
-      "}",
-      "",
-    ].join("\r\n"),
-    "openssl_deactivate-win.sh": [
-      'if [[ "${__CONDA_OPENSSL_CERT_FILE_SET:-}" == "1" ]]; then',
-      "    unset SSL_CERT_FILE",
-      "    unset __CONDA_OPENSSL_CERT_FILE_SET",
-      "fi",
-      "",
-    ].join("\n"),
-  },
-}
-const LEGACY_SSL_CERT_DIR_HOOK_FILES = [
-  "zz_pinokio_unset_ssl_cert_dir-win.bat",
-  "zz_pinokio_unset_ssl_cert_dir-win.ps1",
-  "zz_pinokio_unset_ssl_cert_dir-win.sh",
-]
 
 class Conda {
   description = "Pinokio uses Conda to install various useful programs in an isolated manner."
@@ -124,43 +69,6 @@ class Conda {
     }
     return base
   }
-  async ensureWindowsOpenSslHooks() {
-    if (this.kernel.platform !== "win32") {
-      return
-    }
-    const condaRootDirs = []
-    for (const rootDir of [CONDA_ROOT_DIR, LEGACY_CONDA_ROOT_DIR]) {
-      if (await this.kernel.exists(`bin/${rootDir}/conda-meta`)) {
-        condaRootDirs.push(rootDir)
-      }
-    }
-    if (condaRootDirs.length === 0) {
-      return
-    }
-    for (const rootDir of condaRootDirs) {
-      const activateDir = this.kernel.bin.path(`${rootDir}/etc/conda/activate.d`)
-      const deactivateDir = this.kernel.bin.path(`${rootDir}/etc/conda/deactivate.d`)
-      for (const hookDir of [activateDir, deactivateDir]) {
-        for (const filename of LEGACY_SSL_CERT_DIR_HOOK_FILES) {
-          await fs.promises.rm(path.resolve(hookDir, filename), { force: true }).catch(() => {})
-        }
-      }
-      for (const [filename, content] of Object.entries(WINDOWS_OPENSSL_HOOKS.activate)) {
-        const hookPath = path.resolve(activateDir, filename)
-        const exists = await fs.promises.access(hookPath).then(() => true).catch(() => false)
-        if (exists) {
-          await fs.promises.writeFile(hookPath, content)
-        }
-      }
-      for (const [filename, content] of Object.entries(WINDOWS_OPENSSL_HOOKS.deactivate)) {
-        const hookPath = path.resolve(deactivateDir, filename)
-        const exists = await fs.promises.access(hookPath).then(() => true).catch(() => false)
-        if (exists) {
-          await fs.promises.writeFile(hookPath, content)
-        }
-      }
-    }
-  }
   async init() {
     if (this.kernel.homedir) {
         console.log("condarc init")
@@ -182,7 +90,6 @@ report_errors: false`)
         await fs.promises.writeFile(this.kernel.path(`bin/${CONDA_ROOT_DIR}/conda-meta/pinned`), this.pinnedPackages())
         await this.ensureCompatibilityAlias()
       }
-      await this.ensureWindowsOpenSslHooks()
     }
   }
   async check() {
@@ -205,7 +112,7 @@ report_errors: false`)
           conda_versions[name] = version
           conda_builds[name] = build
           if (name === "conda") {
-            conda_check.conda = true
+            conda_check.conda = isExpectedCondaPinned(version)
           }
           // check conda-libmamba-solver is up to date
           // sometimes it just fails silently so need to check
@@ -307,6 +214,7 @@ report_errors: false`)
     console.log("Conda dependencies to install", { mods })
 
     let condaPackages = [
+      `"conda=${CONDA_PIN_VERSION}"`,
       this.kernel.platform === "win32" ? `"${WINDOWS_PYTHON_SSL_FIX_SPEC}"` : `"${PYTHON_INSTALL_SPEC}"`,
       `"conda-libmamba-solver>=25.4.0"`,
     ]
@@ -330,7 +238,6 @@ report_errors: false`)
         this.kernel.bin.path(CONDA_ROOT_DIR, "python3.exe"),
       )
     }
-    await this.ensureWindowsOpenSslHooks()
     await this.ensureCompatibilityAlias()
     ondata({ raw: `Install finished\r\n` })
     await this.kernel.bin.rm(installer, ondata)

package/kernel/bin/index.js

@@ -23,6 +23,7 @@ const Cuda = require("./cuda")
 const Torch = require("./torch")
 const { buildCondaListFromMeta, managedCondaRuns } = require('./conda-meta')
 const {
+  isExpectedCondaPinned,
   isExpectedPythonPinned,
 } = require('./conda-pins')
 const { glob } = require('glob')
@@ -391,7 +392,7 @@ class Bin {
             conda_versions[name] = version
             conda_builds[name] = build
             if (name === "conda") {
-              conda_check.conda = true
+              conda_check.conda = isExpectedCondaPinned(version)
             }
             if (name === "conda-libmamba-solver") {
               let coerced = semver.coerce(version)
@@ -448,9 +449,6 @@ class Bin {
           break 
         }
       }
-      if (this.mod && this.mod.conda && this.mod.conda.ensureWindowsOpenSslHooks) {
-        await this.mod.conda.ensureWindowsOpenSslHooks()
-      }
     }
 
     if (this.platform === "darwin") {

package/kernel/shell.js

@@ -294,6 +294,14 @@ class Shell {
     setDefaultEnvValue(this.env, "HF_TOKEN_PATH", path.resolve(this.kernel.homedir, "cache", "HF_AUTH", "token"))
 
     if (this.platform === "win32") {
+      const managedSslDir = path.resolve(this.kernel.homedir, "bin", "miniforge", "Library", "ssl")
+      const managedCertFile = path.resolve(managedSslDir, "cacert.pem")
+      const managedCertFileExists = await fs.promises.access(managedCertFile).then(() => true).catch(() => false)
+      if (managedCertFileExists) {
+        setDefaultEnvValue(this.env, "SSL_CERT_FILE", managedCertFile)
+        setDefaultEnvValue(this.env, "SSL_CERT_DIR", managedSslDir)
+      }
+
       // Hugging Face file symlinks regularly fail on non-admin Windows setups.
       // Default to no-symlink cache mode unless the user/app explicitly overrides it.
       setDefaultEnvValue(this.env, "HF_HUB_DISABLE_SYMLINKS", "1")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.0.1",
+  "version": "8.0.3",
   "description": "",
   "main": "index.js",
   "scripts": {

package/test/conda-bin.test.js

@@ -5,10 +5,13 @@ const os = require('node:os')
 const path = require('node:path')
 const test = require('node:test')
 
+const Bin = require('../kernel/bin')
 const Conda = require('../kernel/bin/conda')
 const {
+  CONDA_PIN_VERSION,
   PYTHON_INSTALL_SPEC,
   WINDOWS_PYTHON_SSL_FIX_SPEC,
+  isExpectedCondaPinned,
   isExpectedPythonPinned,
 } = require('../kernel/bin/conda-pins')
 
@@ -41,8 +44,8 @@ async function writeCondaMeta(root, name, version, build = 'py_0') {
   )
 }
 
-async function writeHealthyCondaMeta(root, platform = 'win32') {
-  await writeCondaMeta(root, 'conda', '26.3.2', 'py310')
+async function writeHealthyCondaMeta(root, platform = 'win32', condaVersion = CONDA_PIN_VERSION) {
+  await writeCondaMeta(root, 'conda', condaVersion, 'py310')
   await writeCondaMeta(root, 'conda-libmamba-solver', '25.4.0', 'pyhd3eb1b0_0')
   await writeCondaMeta(root, 'python', '3.10.20', platform === 'win32' ? 'h4de0772_1_cpython' : 'cpython')
 }
@@ -78,86 +81,17 @@ function createConda(kernel) {
   return conda
 }
 
-const EXPECTED_WINDOWS_OPENSSL_HOOKS = {
-  [path.join('activate.d', 'openssl_activate-win.bat')]: [
-    '@echo off',
-    'if "%SSL_CERT_FILE%"=="" (',
-    '    set "SSL_CERT_FILE=%CONDA_PREFIX%\\Library\\ssl\\cacert.pem"',
-    '    set "__CONDA_OPENSSL_CERT_FILE_SET=1"',
-    ')',
-    '',
-  ].join('\r\n'),
-  [path.join('activate.d', 'openssl_activate-win.ps1')]: [
-    'if (-not $Env:SSL_CERT_FILE) {',
-    '    $Env:SSL_CERT_FILE = "$Env:CONDA_PREFIX\\Library\\ssl\\cacert.pem"',
-    '    $Env:__CONDA_OPENSSL_CERT_FILE_SET = "1"',
-    '}',
-    '',
-  ].join('\r\n'),
-  [path.join('activate.d', 'openssl_activate-win.sh')]: [
-    'if [[ "${SSL_CERT_FILE:-}" == "" ]]; then',
-    '    export SSL_CERT_FILE="${CONDA_PREFIX}\\\\Library\\\\ssl\\\\cacert.pem"',
-    '    export __CONDA_OPENSSL_CERT_FILE_SET="1"',
-    'fi',
-    '',
-  ].join('\n'),
-  [path.join('deactivate.d', 'openssl_deactivate-win.bat')]: [
-    '@echo off',
-    'if "%__CONDA_OPENSSL_CERT_FILE_SET%" == "1" (',
-    '    set SSL_CERT_FILE=',
-    '    set __CONDA_OPENSSL_CERT_FILE_SET=',
-    ')',
-    '',
-  ].join('\r\n'),
-  [path.join('deactivate.d', 'openssl_deactivate-win.ps1')]: [
-    'if ($Env:__CONDA_OPENSSL_CERT_FILE_SET -eq "1") {',
-    '    Remove-Item -Path Env:\\SSL_CERT_FILE',
-    '    Remove-Item -Path Env:\\__CONDA_OPENSSL_CERT_FILE_SET',
-    '}',
-    '',
-  ].join('\r\n'),
-  [path.join('deactivate.d', 'openssl_deactivate-win.sh')]: [
-    'if [[ "${__CONDA_OPENSSL_CERT_FILE_SET:-}" == "1" ]]; then',
-    '    unset SSL_CERT_FILE',
-    '    unset __CONDA_OPENSSL_CERT_FILE_SET',
-    'fi',
-    '',
-  ].join('\n'),
-}
-
-async function seedWindowsOpenSslHooks(root, condaRootName) {
-  const condaHookRoot = path.join(root, 'bin', condaRootName, 'etc', 'conda')
-  for (const hookRelativePath of Object.keys(EXPECTED_WINDOWS_OPENSSL_HOOKS)) {
-    const hookPath = path.join(condaHookRoot, hookRelativePath)
-    await fs.mkdir(path.dirname(hookPath), { recursive: true })
-    await fs.writeFile(hookPath, 'upstream hook with SSL_CERT_DIR\n')
-  }
-  for (const hookDirName of ['activate.d', 'deactivate.d']) {
-    for (const filename of [
-      'zz_pinokio_unset_ssl_cert_dir-win.bat',
-      'zz_pinokio_unset_ssl_cert_dir-win.ps1',
-      'zz_pinokio_unset_ssl_cert_dir-win.sh',
-    ]) {
-      await fs.writeFile(path.join(condaHookRoot, hookDirName, filename), 'legacy hook\n')
-    }
-  }
-}
-
-async function assertWindowsOpenSslHooksPatched(root, condaRootName) {
-  const condaHookRoot = path.join(root, 'bin', condaRootName, 'etc', 'conda')
-  for (const [hookRelativePath, expectedContent] of Object.entries(EXPECTED_WINDOWS_OPENSSL_HOOKS)) {
-    const hookPath = path.join(condaHookRoot, hookRelativePath)
-    assert.equal(await fs.readFile(hookPath, 'utf8'), expectedContent)
-  }
-  for (const hookDirName of ['activate.d', 'deactivate.d']) {
-    for (const filename of [
-      'zz_pinokio_unset_ssl_cert_dir-win.bat',
-      'zz_pinokio_unset_ssl_cert_dir-win.ps1',
-      'zz_pinokio_unset_ssl_cert_dir-win.sh',
-    ]) {
-      assert.equal(await pathExists(path.join(condaHookRoot, hookDirName, filename)), false)
-    }
+function createBin(root, platform = 'win32') {
+  const kernel = {
+    homedir: root,
+    platform,
+    path: (...parts) => path.join(root, ...parts),
   }
+  const bin = new Bin(kernel)
+  bin.platform = platform
+  bin.installed = {}
+  kernel.bin = bin
+  return bin
 }
 
 test('Conda uses Miniforge assets and writes conda-forge-only config', async () => {
@@ -181,32 +115,14 @@ test('Conda uses Miniforge assets and writes conda-forge-only config', async ()
   assert.equal(await pathExists(path.join(root, 'bin', 'miniforge')), false)
 })
 
-test('Conda init patches Windows OpenSSL hooks and removes legacy SSL_CERT_DIR hooks', async () => {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-openssl-hooks-'))
-  await fs.mkdir(path.join(root, 'bin', 'miniforge', 'conda-meta'), { recursive: true })
-  await seedWindowsOpenSslHooks(root, 'miniforge')
-  const conda = createConda(createKernel(root))
-
-  await conda.init()
-
-  await assertWindowsOpenSslHooksPatched(root, 'miniforge')
-})
-
-test('Conda init patches Windows OpenSSL hooks for legacy Miniconda roots', async () => {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-legacy-openssl-hooks-'))
-  await fs.mkdir(path.join(root, 'bin', 'miniconda', 'conda-meta'), { recursive: true })
-  await seedWindowsOpenSslHooks(root, 'miniconda')
-  const conda = createConda(createKernel(root))
-
-  await conda.init()
-
-  await assertWindowsOpenSslHooksPatched(root, 'miniconda')
-})
-
-test('Conda pins Python 3.10.20 consistently across platforms', async () => {
+test('Conda pins the managed Conda and Python versions consistently', async () => {
+  assert.equal(CONDA_PIN_VERSION, '26.5.3')
   assert.equal(PYTHON_INSTALL_SPEC, 'python=3.10.20')
   assert.equal(WINDOWS_PYTHON_SSL_FIX_SPEC, 'python=3.10.20=*_1_cpython')
 
+  assert.equal(isExpectedCondaPinned('26.5.3'), true)
+  assert.equal(isExpectedCondaPinned('26.3.2'), false)
+
   assert.equal(isExpectedPythonPinned('darwin', '3.10.20', 'cpython'), true)
   assert.equal(isExpectedPythonPinned('linux', '3.10.20', 'cpython'), true)
   assert.equal(isExpectedPythonPinned('darwin', '3.10.21', 'cpython'), false)
@@ -215,6 +131,47 @@ test('Conda pins Python 3.10.20 consistently across platforms', async () => {
   assert.equal(isExpectedPythonPinned('win32', '3.10.20', 'h4de0772_1_cpython'), true)
 })
 
+test('Conda init writes the current Conda pin into an existing runtime', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-pin-init-'))
+  await createMiniforge(root)
+  await fs.mkdir(path.join(root, 'bin', 'miniforge', 'conda-meta'), { recursive: true })
+
+  await createConda(createKernel(root, 'darwin')).init()
+
+  assert.equal(
+    await fs.readFile(path.join(root, 'bin', 'miniforge', 'conda-meta', 'pinned'), 'utf8'),
+    'conda ==26.5.3'
+  )
+})
+
+test('Conda init leaves Windows OpenSSL activation hooks untouched', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-hooks-untouched-'))
+  const hookRoot = path.join(root, 'bin', 'miniforge', 'etc', 'conda')
+  const hookFiles = [
+    path.join('activate.d', 'openssl_activate-win.bat'),
+    path.join('activate.d', 'openssl_activate-win.ps1'),
+    path.join('activate.d', 'openssl_activate-win.sh'),
+    path.join('deactivate.d', 'openssl_deactivate-win.bat'),
+    path.join('deactivate.d', 'openssl_deactivate-win.ps1'),
+    path.join('deactivate.d', 'openssl_deactivate-win.sh'),
+  ]
+  await fs.mkdir(path.join(root, 'bin', 'miniforge', 'conda-meta'), { recursive: true })
+  for (const relativePath of hookFiles) {
+    const hookPath = path.join(hookRoot, relativePath)
+    await fs.mkdir(path.dirname(hookPath), { recursive: true })
+    await fs.writeFile(hookPath, `upstream ${relativePath}\n`)
+  }
+
+  await createConda(createKernel(root, 'win32')).init()
+
+  for (const relativePath of hookFiles) {
+    assert.equal(
+      await fs.readFile(path.join(hookRoot, relativePath), 'utf8'),
+      `upstream ${relativePath}\n`
+    )
+  }
+})
+
 test('Conda install requests the Python 3.10.20 pin on macOS/Linux', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-python-pin-darwin-'))
   const kernel = createKernel(root, 'darwin')
@@ -237,7 +194,11 @@ test('Conda install requests the Python 3.10.20 pin on macOS/Linux', async () =>
   assert.ok(condaInstall)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "python=3.10.20" "conda-libmamba-solver>=25.4.0"'
+    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0"'
+  )
+  assert.equal(
+    await fs.readFile(path.join(root, 'bin', 'miniforge', 'conda-meta', 'pinned'), 'utf8'),
+    'conda ==26.5.3'
   )
 })
 
@@ -265,7 +226,39 @@ test('Conda install keeps the Windows Python 3.10.20 SSL-fixed build pin', async
   assert.ok(condaInstall)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "python=3.10.20=*_1_cpython" "conda-libmamba-solver>=25.4.0"'
+    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20=*_1_cpython" "conda-libmamba-solver>=25.4.0"'
+  )
+})
+
+test('Conda install replaces the stale runtime and rebuilds declared Conda modules', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-full-reset-'))
+  const staleRoot = await createMiniforge(root)
+  const staleMarker = path.join(staleRoot, 'stale-runtime.txt')
+  await fs.writeFile(staleMarker, 'remove me\n')
+  const kernel = createKernel(root, 'darwin')
+  const calls = []
+
+  kernel.bin.mods = [
+    { name: 'uv', mod: { cmd: () => 'uv=0.11.23' } },
+    { name: 'node', mod: { cmd: () => 'nodejs=22.21.1 pnpm' } },
+  ]
+  kernel.bin.download = async () => {}
+  kernel.bin.rm = async () => {}
+  kernel.bin.exec = async (payload) => {
+    calls.push(payload)
+    if (payload && payload.conda && payload.conda.skip) {
+      await fs.mkdir(path.join(root, 'bin', 'miniforge', 'conda-meta'), { recursive: true })
+    }
+  }
+
+  await createConda(kernel)._install({ dependencies: ['uv', 'node'] }, () => {})
+
+  assert.equal(await pathExists(staleMarker), false)
+  const condaInstall = calls.find((call) => Array.isArray(call.message))
+  assert.ok(condaInstall)
+  assert.equal(
+    condaInstall.message[1],
+    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" uv=0.11.23 nodejs=22.21.1 pnpm'
   )
 })
 
@@ -331,6 +324,14 @@ test('Conda check rejects metadata-only Windows installs', async () => {
   assert.equal(await createConda(createKernel(root, 'win32')).check(), false)
 })
 
+test('Conda check rejects a runnable runtime with the previous Conda version', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-version-stale-'))
+  await writeHealthyCondaMeta(root, 'win32', '26.3.2')
+  await writeFakeManagedConda(root, 'win32')
+
+  assert.equal(await createConda(createKernel(root, 'win32')).check(), false)
+})
+
 test('Conda check accepts a runnable managed Windows conda executable', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-smoke-runnable-'))
   await writeHealthyCondaMeta(root, 'win32')
@@ -339,9 +340,29 @@ test('Conda check accepts a runnable managed Windows conda executable', async ()
   assert.equal(await createConda(createKernel(root, 'win32')).check(), true)
 })
 
+test('Bin readiness rejects the previous Conda version and accepts the pinned version', async () => {
+  const staleRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-bin-conda-version-stale-'))
+  await writeHealthyCondaMeta(staleRoot, 'win32', '26.3.2')
+  await writeFakeManagedConda(staleRoot, 'win32')
+  const staleBin = createBin(staleRoot, 'win32')
+
+  await staleBin.tryList()
+  assert.equal(staleBin.correct_conda, false)
+
+  const currentRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-bin-conda-version-current-'))
+  await writeHealthyCondaMeta(currentRoot, 'win32')
+  await writeFakeManagedConda(currentRoot, 'win32')
+  const currentBin = createBin(currentRoot, 'win32')
+
+  await currentBin.tryList()
+  assert.equal(currentBin.correct_conda, true)
+})
+
 test('Conda install keeps the old runtime when the replacement installer download fails', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-download-fails-'))
-  const miniconda = await createLegacyMiniconda(root)
+  const miniforge = await createMiniforge(root)
+  const oldRuntimeFile = path.join(miniforge, 'old-runtime.txt')
+  await fs.writeFile(oldRuntimeFile, 'keep me\n')
   const kernel = createKernel(root)
 
   kernel.bin.download = async () => {
@@ -352,8 +373,29 @@ test('Conda install keeps the old runtime when the replacement installer downloa
     createConda(kernel)._install({ dependencies: [] }, () => {}),
     /download failed/
   )
-  assert.equal(await pathExists(miniconda), true)
-  assert.equal(await pathExists(path.join(root, 'bin', 'miniforge')), false)
+  assert.equal(await pathExists(oldRuntimeFile), true)
+})
+
+test('Conda install propagates bootstrap failure after replacing the runtime', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-bootstrap-fails-'))
+  await createMiniforge(root)
+  const kernel = createKernel(root, 'darwin')
+
+  kernel.bin.mods = []
+  kernel.bin.download = async () => {}
+  kernel.bin.rm = async () => {}
+  kernel.bin.exec = async (payload) => {
+    if (payload && payload.conda && payload.conda.skip) {
+      await fs.mkdir(path.join(root, 'bin', 'miniforge', 'conda-meta'), { recursive: true })
+      return
+    }
+    throw new Error('bootstrap failed')
+  }
+
+  await assert.rejects(
+    createConda(kernel)._install({ dependencies: [] }, () => {}),
+    /bootstrap failed/
+  )
 })
 
 test('Conda install reports manual recovery when the old runtime cannot be removed', async () => {

package/test/shell-run-template.test.js

@@ -197,6 +197,48 @@ test('Shell.init_env keeps Windows Hugging Face symlink defaults scoped to win32
   assert.equal(winShell.env.HF_HUB_DISABLE_SYMLINKS_WARNING, '1')
 })
 
+test('Shell.init_env gives Windows uv a valid managed certificate directory without overriding apps', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-shell-ssl-win-'))
+  const managedSslDir = path.join(root, 'bin', 'miniforge', 'Library', 'ssl')
+  const managedCertFile = path.join(managedSslDir, 'cacert.pem')
+  await fs.mkdir(path.join(root, 'api'), { recursive: true })
+  await fs.mkdir(managedSslDir, { recursive: true })
+  await fs.writeFile(path.join(root, 'ENVIRONMENT'), 'PINOKIO_TEST_ENV=1\n')
+  await fs.writeFile(managedCertFile, 'test certificate bundle\n')
+
+  const defaultShell = createShell(createKernel(root))
+  defaultShell.platform = 'win32'
+  await defaultShell.init_env({
+    path: process.cwd(),
+    env: {}
+  })
+  assert.equal(defaultShell.env.SSL_CERT_FILE, managedCertFile)
+  assert.equal(defaultShell.env.SSL_CERT_DIR, managedSslDir)
+
+  const customCertFile = path.join(root, 'custom', 'certs.pem')
+  const customCertDir = path.join(root, 'custom', 'certs')
+  const overrideShell = createShell(createKernel(root))
+  overrideShell.platform = 'win32'
+  await overrideShell.init_env({
+    path: process.cwd(),
+    env: {
+      SSL_CERT_FILE: customCertFile,
+      SSL_CERT_DIR: customCertDir
+    }
+  })
+  assert.equal(overrideShell.env.SSL_CERT_FILE, customCertFile)
+  assert.equal(overrideShell.env.SSL_CERT_DIR, customCertDir)
+
+  const darwinShell = createShell(createKernel(root))
+  darwinShell.platform = 'darwin'
+  await darwinShell.init_env({
+    path: process.cwd(),
+    env: {}
+  })
+  assert.equal(darwinShell.env.SSL_CERT_FILE, undefined)
+  assert.equal(darwinShell.env.SSL_CERT_DIR, undefined)
+})
+
 test('redactEnvArgs summarizes protected argv env values', () => {
   const redacted = ShellRunTemplate.redactEnvArgs({
     PINOKIO_ARG_0: 'line one\nline two',