pinokiod 8.0.3 → 8.0.5

package/kernel/bin/caddy.js

@@ -8,6 +8,7 @@ const Util = require('../util')
 const ADMIN_READY_TIMEOUT_MS = 30000
 const ADMIN_START_TIMEOUT_MS = 5000
 const ADMIN_POLL_INTERVAL_MS = 250
+const ADMIN_STOP_TIMEOUT_MS = 5000
 
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
 
@@ -29,6 +30,35 @@ class Caddy {
       return false
     }
   }
+  async waitForStopped(timeout = ADMIN_STOP_TIMEOUT_MS, interval = ADMIN_POLL_INTERVAL_MS) {
+    const started = Date.now()
+    while ((Date.now() - started) < timeout) {
+      if (!(await this.running())) {
+        return true
+      }
+      await sleep(interval)
+    }
+    return !(await this.running())
+  }
+  async stop() {
+    if (!(await this.running())) {
+      return false
+    }
+    try {
+      await axios.post('http://127.0.0.1:2019/stop', null, {
+        timeout: ADMIN_STOP_TIMEOUT_MS
+      })
+    } catch (error) {
+      if (await this.running()) {
+        throw error
+      }
+    }
+    const stopped = await this.waitForStopped()
+    if (!stopped) {
+      throw new Error("Pinokio could not stop Caddy before replacing the managed Conda runtime.")
+    }
+    return true
+  }
   async start() {
     // if peer.https_active is true,
     // 1. kill existing caddy

package/kernel/bin/conda.js

@@ -170,6 +170,16 @@ report_errors: false`)
     ondata({ raw: `downloading installer: ${installer_url}...\r\n` })
     await this.kernel.bin.download(installer_url, installer, ondata)
 
+    const caddy = this.kernel.bin.mod && this.kernel.bin.mod.caddy
+    let caddyWasRunning = false
+    if (caddy && typeof caddy.running === "function") {
+      caddyWasRunning = await caddy.running()
+    }
+    if (caddyWasRunning) {
+      ondata({ raw: `stopping Home Server before replacing Miniforge...\r\n` })
+      await caddy.stop()
+    }
+
     legacy_path_exists = await this.kernel.exists(`bin/${LEGACY_CONDA_ROOT_DIR}`)
     if (legacy_path_exists) {
       console.log("Removing legacy install path...", legacy_path)
@@ -202,8 +212,12 @@ report_errors: false`)
       await fs.promises.writeFile(this.kernel.path(`bin/${CONDA_ROOT_DIR}/conda-meta/pinned`), this.pinnedPackages())
     }
 
+    const dependencies = new Set(Array.isArray(req.dependencies) ? req.dependencies : [])
+    if (caddyWasRunning) {
+      dependencies.add("caddy")
+    }
     let mods = this.kernel.bin.mods.filter((m) => {
-      return req.dependencies.includes(m.name)
+      return dependencies.has(m.name)
     }).map((m) => {
       if (m.mod.cmd) {
         return m.mod.cmd()
@@ -241,6 +255,10 @@ report_errors: false`)
     await this.ensureCompatibilityAlias()
     ondata({ raw: `Install finished\r\n` })
     await this.kernel.bin.rm(installer, ondata)
+    if (caddyWasRunning) {
+      ondata({ raw: `restarting Home Server after replacing Miniforge...\r\n` })
+      await caddy.start()
+    }
   }
   async removeInstallPath(target) {
     try {

package/kernel/connect/index.js

@@ -42,5 +42,11 @@ class Connect {
     let res = await this.clients[provider].keys()
     return res
   }
+  async connected(provider, options) {
+    if (this.clients[provider] && this.clients[provider].connected) {
+      return await this.clients[provider].connected(options)
+    }
+    return false
+  }
 }
 module.exports = Connect

package/kernel/connect/providers/huggingface/index.js

@@ -34,6 +34,13 @@ class Huggingface {
     }
     delete env.HF_TOKEN
     delete env.HUGGING_FACE_HUB_TOKEN
+    try {
+      await fs.promises.rmdir(env.HF_TOKEN_PATH)
+    } catch (error) {
+      if (!error || !["ENOENT", "ENOTDIR"].includes(error.code)) {
+        throw new Error(`Hugging Face token path must be a file: ${env.HF_TOKEN_PATH}`)
+      }
+    }
     await fs.promises.mkdir(path.dirname(env.HF_TOKEN_PATH), { recursive: true }).catch(() => {})
     return env
   }
@@ -52,12 +59,13 @@ class Huggingface {
     }
     return candidates[0]
   }
-  async runHf(args) {
+  async runHf(args, options = {}) {
     const env = await this.authEnv()
     return new Promise((resolve, reject) => {
       execFile(this.hfPath(), args, {
         cwd: this.kernel.homedir,
         env,
+        timeout: Number.isFinite(options.timeout) ? options.timeout : undefined,
         maxBuffer: 1024 * 1024,
       }, (error, stdout, stderr) => {
         if (error) {
@@ -199,6 +207,14 @@ class Huggingface {
       return null
     }
   }
+  async connected(options = {}) {
+    try {
+      await this.runHf(["auth", "whoami", "--format", "quiet"], options)
+      return true
+    } catch (_) {
+      return false
+    }
+  }
   async profile() {
     const keys = await this.keys()
     if (!keys || !keys.access_token) {

package/kernel/environment.js

@@ -489,21 +489,6 @@ const ENVS = async () => {
       "#",
       "##########################################################################",
     ],
-  }, {
-    type: ["system"],
-    key: "HF_TOKEN_PATH",
-    val: "./cache/HF_AUTH/token",
-    comment: [
-      "##########################################################################",
-      "#",
-      "# HF_TOKEN_PATH",
-      "#",
-      "# Hugging Face authentication token file",
-      "# Pinokio keeps this shared across apps so each app can customize HF_HOME",
-      "# for model/cache files without changing the logged-in Hugging Face account.",
-      "#",
-      "##########################################################################",
-    ],
   }, {
     type: ["system", "app"],
     key: "TORCH_HOME",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.0.3",
+  "version": "8.0.5",
   "description": "",
   "main": "index.js",
   "scripts": {

package/server/index.js

@@ -28,6 +28,7 @@ const system = require('systeminformation')
 const serveIndex = require('./serveIndex')
 const registerFileRoutes = require('./routes/files')
 const registerAppRoutes = require('./routes/apps')
+const registerConnectRoutes = require('./routes/connect')
 const ServerAutolaunch = require('./autolaunch')
 const Git = require("../kernel/git")
 const TerminalApi = require('../kernel/api/terminal')
@@ -1500,7 +1501,7 @@ class Server {
       )
     })
   }
-  async get_github_connection() {
+  async get_github_connection(options = {}) {
     if (this._githubConnectionPromise) {
       return this._githubConnectionPromise
     }
@@ -1511,7 +1512,9 @@ class Server {
       let gcmError = null
 
       try {
-        const stdout = await this.github_gcm(['list'], { timeout: 10000 })
+        const stdout = await this.github_gcm(['list'], {
+          timeout: Number.isFinite(options.timeout) ? options.timeout : 10000
+        })
         accounts = stdout
           .split(/\r?\n/)
           .map((line) => line.trim())
@@ -1550,7 +1553,7 @@ class Server {
       ? "echo P^INOKIO_GITHUB_LOGIN_DONE"
       : "(GCM_DONE=INOKIO_GITHUB_LOGIN_DONE; printf 'P%s\\n' \"$GCM_DONE\")"
     const loginCommand = [
-      "git credential-manager github login --web --force",
+      "git credential-manager github login --device --force",
       verifyCommand,
       doneCommand
     ].join(" && ")
@@ -12668,80 +12671,19 @@ class Server {
 
     /*
     GET /connect => display connection options
+    - huggingface
     - github
-    - x
     */
-    this.app.get("/connect", ex(async (req, res) => {
-      let list = this.getPeers()
-      let current_urls = await this.current_urls(req.originalUrl.slice(1))
-      let items = [{
-//        image: "/pinokio-black.png",
-//        name: "pinokio",
-//        title: "pinokio.co",
-//        description: "Connect with pinokio.co",
-//        url: "/connect/pinokio"
-//      }, {
-        icon: "fa-brands fa-hugging-face",
-        name: "huggingface",
-        title: "huggingface.co",
-        description: "Connect with huggingface.co",
-        url: "/connect/huggingface"
-      }, {
-        icon: "fa-brands fa-github",
-        name: "github",
-        title: "github.com",
-        description: "Connect with GitHub.com",
-        url: "/github"
-      }, {
-        icon: "fa-brands fa-square-x-twitter",
-        name: "x",
-        title: "x.com",
-        description: "Connect with X.com",
-        url: "/connect/x",
-        hidden: true
-      }]
-      let github_hosts = await this.get_github_hosts()
-      for(let i=0; i<items.length; i++) {
-        try {
-          if (items[i].name === "github") {
-            if (github_hosts.length > 0) {
-              items[i].profile = {
-                icon: "fa-brands fa-github",
-                items: [{
-                  key: "config",
-                  val: github_hosts
-                }]
-              }
-              items[i].description = `<i class="fa-solid fa-circle-check"></i> Connected with ${items[i].title}`
-              items[i].connected = true
-            }
-          } else {
-            const config = this.kernel.connect.config[items[i].name]
-            if (config) {
-              let profile = await this.kernel.connect.profile(items[i].name)
-              if (profile) {
-                items[i].profile = profile 
-                items[i].description = `<i class="fa-solid fa-circle-check"></i> Connected with ${items[i].title}`
-                items[i].connected = true
-              }
-            }
-          }
-        } catch (e) {
-        }
-      }
-      const peerAccess = await this.composePeerAccessPayload()
-      res.render(`connect`, {
-        current_urls,
-        current_host: this.kernel.peer.host,
-        ...peerAccess,
-        list,
+    registerConnectRoutes(this.app, {
+      getPageContext: (req) => ({
         portal: this.portal,
         logo: this.logo,
         theme: this.theme,
-        agent: req.agent,
-        items: items.filter((item) => !item.hidden),
-      })
-    }))
+        agent: req.agent
+      }),
+      getGithubConnection: (options) => this.get_github_connection(options),
+      getProviderConnection: (provider, options) => this.kernel.connect.connected(provider, options)
+    })
     /*
     *  GET /connect/x
     *  GET /connect/discord
@@ -13514,6 +13456,7 @@ class Server {
     }))
     this.app.get("/github/login", ex(async (req, res) => {
       let id = "gh_login"
+      this.kernel.shell.kill({ id: `shell/${id}` })
       let params = new URLSearchParams()
       const { doneMarker, message } = this.github_login_params()
       params.set("message", encodeURIComponent(message))

package/server/public/task-launcher.css

@@ -2618,6 +2618,10 @@ body.connect-page .connect-service-status {
   font-weight: 700;
 }
 
+body.connect-page .connect-service-status[hidden] {
+  display: none;
+}
+
 body.connect-page .connect-service-open {
   color: var(--task-muted);
   font-size: 15px;

package/server/routes/connect.js

@@ -0,0 +1,49 @@
+const CONNECT_STATUS_TIMEOUT_MS = 3000
+
+const CONNECT_ITEMS = [{
+  icon: "fa-brands fa-hugging-face",
+  name: "huggingface",
+  title: "huggingface.co",
+  description: "Connect with huggingface.co",
+  url: "/connect/huggingface"
+}, {
+  icon: "fa-brands fa-github",
+  name: "github",
+  title: "github.com",
+  description: "Connect with GitHub.com",
+  url: "/github"
+}]
+
+module.exports = function registerConnectRoutes(app, options = {}) {
+  const getPageContext = options.getPageContext || (() => ({}))
+  const getGithubConnection = options.getGithubConnection
+  const getProviderConnection = options.getProviderConnection
+  const statusTimeoutMs = Number.isFinite(options.statusTimeoutMs)
+    ? options.statusTimeoutMs
+    : CONNECT_STATUS_TIMEOUT_MS
+
+  app.get("/connect", (req, res) => {
+    res.render("connect", {
+      ...getPageContext(req),
+      items: CONNECT_ITEMS
+    })
+  })
+
+  app.get("/connect/status/:provider", async (req, res) => {
+    const provider = String(req.params.provider || "")
+    let connected = false
+    try {
+      if (provider === "github" && typeof getGithubConnection === "function") {
+        const connection = await getGithubConnection({ timeout: statusTimeoutMs })
+        connected = Boolean(connection && connection.connected)
+      } else if (provider === "huggingface" && typeof getProviderConnection === "function") {
+        connected = await getProviderConnection(provider, { timeout: statusTimeoutMs })
+      } else {
+        res.status(404).json({ provider, error: "Unknown provider" })
+        return
+      }
+    } catch (_) {}
+    res.set("Cache-Control", "no-store")
+    res.json({ provider, connected: Boolean(connected) })
+  })
+}

package/server/views/connect.ejs

@@ -818,56 +818,31 @@ body.dark .profile td {
         <% } else { %>
           <div class='connect-service-list'>
       <% items.forEach((item) => { %>
-        <% if (item.profile) { %>
-          <a href="<%=item.url%>" class="connect-service-card connect-service-card-connected">
-            <div class='connect-service-head'>
-              <div class='connect-service-icon'>
-                <% if (item.image) { %>
-                  <img class="connect-service-icon-image" src="<%=item.image%>" alt="">
-                <% } else if (item.icon) { %>
-                  <i class="<%=item.icon%>"></i>
-                <% } else if (item.emoji) { %>
-                  <span><%=item.emoji%></span>
-                <% } else { %>
-                  <i class="fa-solid fa-plug"></i>
-                <% } %>
-              </div>
-              <div class='connect-service-copy'>
-                <div class='connect-service-title-row'>
-                  <h2 class='connect-service-title'><%=item.title%></h2>
-                  <span class='connect-service-status'>Connected</span>
-                </div>
-                <div class='connect-service-description'><%- item.description %></div>
-              </div>
-              <div class='connect-service-open' aria-hidden='true'>
-                <i class="fa-solid fa-chevron-right"></i>
-              </div>
+        <a href="<%=item.url%>" class="connect-service-card" data-connect-provider="<%=item.name%>">
+          <div class='connect-service-head'>
+            <div class='connect-service-icon'>
+              <% if (item.image) { %>
+                <img class="connect-service-icon-image" src="<%=item.image%>" alt="">
+              <% } else if (item.icon) { %>
+                <i class="<%=item.icon%>"></i>
+              <% } else if (item.emoji) { %>
+                <span><%=item.emoji%></span>
+              <% } else { %>
+                <i class="fa-solid fa-plug"></i>
+              <% } %>
             </div>
-          </a>
-        <% } else { %>
-          <a href="<%=item.url%>" class="connect-service-card">
-            <div class='connect-service-head'>
-              <div class='connect-service-icon'>
-                <% if (item.image) { %>
-                  <img class="connect-service-icon-image" src="<%=item.image%>" alt="">
-                <% } else if (item.icon) { %>
-                  <i class="<%=item.icon%>"></i>
-                <% } else if (item.emoji) { %>
-                  <span><%=item.emoji%></span>
-                <% } else { %>
-                  <i class="fa-solid fa-plug"></i>
-                <% } %>
-              </div>
-              <div class='connect-service-copy'>
+            <div class='connect-service-copy'>
+              <div class='connect-service-title-row'>
                 <h2 class='connect-service-title'><%=item.title%></h2>
-                <div class="connect-service-description"><%=item.description%></div>
-              </div>
-              <div class="connect-service-open" aria-hidden='true'>
-                <i class="fa-solid fa-chevron-right"></i>
+                <span class='connect-service-status' data-connect-status aria-live="polite">Checking...</span>
               </div>
+              <div class="connect-service-description" data-connect-description><%=item.description%></div>
             </div>
-          </a>
-        <% } %>
+            <div class="connect-service-open" aria-hidden='true'>
+              <i class="fa-solid fa-chevron-right"></i>
+            </div>
+          </div>
+        </a>
       <% }) %>
           </div>
         <% } %>
@@ -878,5 +853,50 @@ body.dark .profile td {
 <%- include('partials/main_sidebar', { selected: 'connect' }) %>
 </main>
 <%- include('partials/app_common_scripts') %>
+<script>
+  (() => {
+    const cards = document.querySelectorAll("[data-connect-provider]")
+    cards.forEach((card) => {
+      const provider = card.dataset.connectProvider
+      const status = card.querySelector("[data-connect-status]")
+      const description = card.querySelector("[data-connect-description]")
+      const title = card.querySelector(".connect-service-title")
+      const controller = new AbortController()
+      const timer = window.setTimeout(() => controller.abort(), 4000)
+
+      fetch(`/connect/status/${encodeURIComponent(provider)}`, {
+        cache: "no-store",
+        headers: { "Accept": "application/json" },
+        signal: controller.signal
+      }).then((response) => {
+        if (!response.ok) {
+          throw new Error(`Status request failed: ${response.status}`)
+        }
+        return response.json()
+      }).then((result) => {
+        const connected = Boolean(result && result.connected)
+        if (!connected) {
+          if (status) {
+            status.hidden = true
+          }
+          return
+        }
+        if (status) {
+          status.textContent = "Connected"
+          status.hidden = false
+        }
+        if (description && title) {
+          description.textContent = `Connected with ${title.textContent}`
+        }
+      }).catch(() => {
+        if (status) {
+          status.hidden = true
+        }
+      }).finally(() => {
+        window.clearTimeout(timer)
+      })
+    })
+  })()
+</script>
 </body>
 </html>

package/server/views/install.ejs

@@ -64,6 +64,9 @@ body.install-page > .terminal-container {
   height: 100%;
   min-height: 0;
 }
+body.install-page #terminal .xterm {
+  padding-top: 10px !important;
+}
 .line2 {
   display: flex;
   align-items: center;

package/test/caddy-install.test.js

@@ -51,3 +51,68 @@ test('caddy admin wait returns true when admin responds', async () => {
   assert.equal(ready, true)
   assert.equal(checks, 2)
 })
+
+test('caddy start uses the normal shell execution contract', async () => {
+  const caddy = new Caddy()
+  let running = false
+  let launch
+  caddy.kernel = {
+    homedir: '/tmp/pinokio',
+    peer: {
+      https_active: true,
+      announce() {}
+    },
+    processes: {},
+    exec(params, ondata) {
+      launch = params
+      running = true
+      ondata({ raw: '', cleaned: 'admin endpoint started' })
+    }
+  }
+  caddy.running = async () => running
+  caddy.installed = async () => true
+
+  await caddy.start()
+
+  assert.equal(launch.message, 'caddy run --watch')
+  assert.deepEqual(Object.keys(launch).sort(), ['message', 'path'])
+})
+
+test('caddy stop uses the native admin API only when Caddy is running', async () => {
+  const caddy = new Caddy()
+  let running = true
+  caddy.running = async () => running
+  const originalPost = require('axios').post
+  const calls = []
+  require('axios').post = async (...args) => {
+    calls.push(args)
+    running = false
+  }
+
+  try {
+    assert.equal(await caddy.stop(), true)
+    assert.equal(await caddy.stop(), false)
+  } finally {
+    require('axios').post = originalPost
+  }
+
+  assert.equal(calls.length, 1)
+  assert.equal(calls[0][0], 'http://127.0.0.1:2019/stop')
+})
+
+test('caddy stop refuses to continue when native shutdown is not confirmed', async () => {
+  const caddy = new Caddy()
+  caddy.running = async () => true
+  caddy.waitForStopped = async () => false
+  const originalPost = require('axios').post
+  require('axios').post = async () => {}
+
+  try {
+    await assert.rejects(
+      caddy.stop(),
+      /could not stop Caddy/
+    )
+  } finally {
+    require('axios').post = originalPost
+  }
+})

package/test/conda-bin.test.js

@@ -262,6 +262,60 @@ test('Conda install replaces the stale runtime and rebuilds declared Conda modul
   )
 })
 
+test('Conda replacement stops, preserves, and restarts a running managed Caddy', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-caddy-lifecycle-'))
+  await createMiniforge(root)
+  const kernel = createKernel(root, 'win32')
+  const events = []
+  let caddyRunning = true
+  let condaInstall
+
+  const caddy = {
+    cmd: () => 'caddy=2.9.1',
+    running: async () => caddyRunning,
+    stop: async () => {
+      events.push('caddy-stop')
+      caddyRunning = false
+    },
+    start: async () => {
+      events.push('caddy-start')
+      caddyRunning = true
+    },
+  }
+  kernel.bin.installed.conda = new Set(['caddy'])
+  kernel.bin.mod = { caddy }
+  kernel.bin.mods = [{ name: 'caddy', mod: caddy }]
+  kernel.bin.download = async () => events.push('download')
+  kernel.bin.rm = async () => events.push('installer-cleanup')
+  kernel.bin.exec = async (payload) => {
+    if (payload && payload.conda && payload.conda.skip) {
+      events.push('bootstrap')
+      const miniforge = path.join(root, 'bin', 'miniforge')
+      await fs.mkdir(path.join(miniforge, 'conda-meta'), { recursive: true })
+      await fs.writeFile(path.join(miniforge, 'python.exe'), 'fake python\n')
+      return
+    }
+    events.push('conda-install')
+    condaInstall = payload
+  }
+
+  const conda = createConda(kernel)
+  const removeInstallPath = conda.removeInstallPath.bind(conda)
+  conda.removeInstallPath = async (target) => {
+    assert.equal(caddyRunning, false)
+    events.push('remove-miniforge')
+    await removeInstallPath(target)
+  }
+
+  await conda._install({ dependencies: [] }, () => {})
+
+  assert.ok(events.indexOf('caddy-stop') < events.indexOf('remove-miniforge'))
+  assert.ok(events.indexOf('remove-miniforge') < events.indexOf('bootstrap'))
+  assert.ok(events.indexOf('conda-install') < events.indexOf('caddy-start'))
+  assert.match(condaInstall.message[1], / caddy=2\.9\.1$/)
+  assert.equal(caddyRunning, true)
+})
+
 test('Conda install replaces legacy miniconda with a compatibility alias to miniforge', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-miniforge-alias-'))
   const legacy = await createLegacyMiniconda(root)

package/test/connect-page-route.test.js

@@ -0,0 +1,143 @@
+const assert = require('node:assert/strict')
+const http = require('node:http')
+const path = require('node:path')
+const test = require('node:test')
+const express = require('express')
+const registerConnectRoutes = require('../server/routes/connect')
+
+const viewsPath = path.resolve(__dirname, '..', 'server', 'views')
+
+async function startConnectServer(options = {}) {
+  const app = express()
+  app.set('views', viewsPath)
+  app.set('view engine', 'ejs')
+  registerConnectRoutes(app, {
+    getPageContext: () => ({
+      portal: '',
+      logo: '',
+      theme: 'light',
+      agent: 'test'
+    }),
+    getGithubConnection: options.getGithubConnection,
+    getProviderConnection: options.getProviderConnection,
+    statusTimeoutMs: options.statusTimeoutMs
+  })
+  app.use((error, req, res, next) => {
+    res.status(500).send(error.message)
+  })
+
+  const server = http.createServer(app)
+  await new Promise((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', resolve)
+  })
+  const address = server.address()
+  return {
+    baseUrl: `http://127.0.0.1:${address.port}`,
+    close: () => new Promise((resolve, reject) => {
+      server.close((error) => error ? reject(error) : resolve())
+    })
+  }
+}
+
+async function fetchWithin(url, timeoutMs = 500) {
+  const controller = new AbortController()
+  const timer = setTimeout(() => controller.abort(), timeoutMs)
+  try {
+    return await fetch(url, { signal: controller.signal })
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+test('/connect renders without invoking provider status checks', async () => {
+  let githubCalls = 0
+  let huggingfaceCalls = 0
+  const fixture = await startConnectServer({
+    getGithubConnection: async () => {
+      githubCalls += 1
+      return await new Promise(() => {})
+    },
+    getProviderConnection: async () => {
+      huggingfaceCalls += 1
+      return await new Promise(() => {})
+    }
+  })
+
+  try {
+    const response = await fetchWithin(`${fixture.baseUrl}/connect`)
+    const html = await response.text()
+
+    assert.equal(response.status, 200)
+    assert.equal(githubCalls, 0)
+    assert.equal(huggingfaceCalls, 0)
+    assert.match(html, /data-connect-provider="huggingface"/)
+    assert.match(html, /data-connect-provider="github"/)
+    assert.match(html, /Checking\.\.\./)
+  } finally {
+    await fixture.close()
+  }
+})
+
+test('/connect status endpoints check providers independently with bounded options', async () => {
+  const calls = []
+  const fixture = await startConnectServer({
+    statusTimeoutMs: 75,
+    getGithubConnection: async (options) => {
+      calls.push({ provider: 'github', options })
+      return { connected: true }
+    },
+    getProviderConnection: async (provider, options) => {
+      calls.push({ provider, options })
+      return false
+    }
+  })
+
+  try {
+    const [githubResponse, huggingfaceResponse] = await Promise.all([
+      fetch(`${fixture.baseUrl}/connect/status/github`),
+      fetch(`${fixture.baseUrl}/connect/status/huggingface`)
+    ])
+    const github = await githubResponse.json()
+    const huggingface = await huggingfaceResponse.json()
+
+    assert.deepEqual(github, { provider: 'github', connected: true })
+    assert.deepEqual(huggingface, { provider: 'huggingface', connected: false })
+    assert.deepEqual(calls, [{
+      provider: 'github',
+      options: { timeout: 75 }
+    }, {
+      provider: 'huggingface',
+      options: { timeout: 75 }
+    }])
+    assert.match(githubResponse.headers.get('cache-control'), /no-store/)
+  } finally {
+    await fixture.close()
+  }
+})
+
+test('/connect status endpoints degrade provider errors to disconnected', async () => {
+  const fixture = await startConnectServer({
+    statusTimeoutMs: 30,
+    getGithubConnection: async () => {
+      throw new Error('github unavailable')
+    },
+    getProviderConnection: async () => {
+      throw new Error('huggingface unavailable')
+    }
+  })
+
+  try {
+    const [githubResponse, huggingfaceResponse] = await Promise.all([
+      fetch(`${fixture.baseUrl}/connect/status/github`),
+      fetch(`${fixture.baseUrl}/connect/status/huggingface`)
+    ])
+
+    assert.equal(githubResponse.status, 200)
+    assert.equal(huggingfaceResponse.status, 200)
+    assert.deepEqual(await githubResponse.json(), { provider: 'github', connected: false })
+    assert.deepEqual(await huggingfaceResponse.json(), { provider: 'huggingface', connected: false })
+  } finally {
+    await fixture.close()
+  }
+})

package/test/github-connection.test.js

@@ -36,6 +36,19 @@ test('GitHub connection reports GCM accounts as connected', async () => {
   assert.equal(connection.display, 'github.com: octocat')
 })
 
+test('GitHub connection forwards a bounded timeout to GCM status checks', async () => {
+  let receivedOptions
+  await Server.prototype.get_github_connection.call({
+    get_legacy_github_hosts: async () => '',
+    github_gcm: async (args, options) => {
+      receivedOptions = options
+      return ''
+    },
+  }, { timeout: 2500 })
+
+  assert.deepEqual(receivedOptions, { timeout: 2500 })
+})
+
 test('GitHub connection coalesces only concurrent GCM checks', async () => {
   let calls = 0
   const context = {
@@ -66,8 +79,9 @@ test('GitHub login only emits completion marker after credential verification',
   })
 
   assert.equal(doneMarker, 'PINOKIO_GITHUB_LOGIN_DONE')
-  assert.match(message, /git credential-manager github login --web --force && printf 'protocol=https\\nhost=github\.com\\n\\n' \| GIT_TERMINAL_PROMPT=0 GCM_INTERACTIVE=never git credential fill >\/dev\/null && \(GCM_DONE=INOKIO_GITHUB_LOGIN_DONE; printf 'P%s\\n' "\$GCM_DONE"\)/)
-  assert.doesNotMatch(message, /git credential-manager github login --web --force\s*;/)
+  assert.match(message, /git credential-manager github login --device --force && printf 'protocol=https\\nhost=github\.com\\n\\n' \| GIT_TERMINAL_PROMPT=0 GCM_INTERACTIVE=never git credential fill >\/dev\/null && \(GCM_DONE=INOKIO_GITHUB_LOGIN_DONE; printf 'P%s\\n' "\$GCM_DONE"\)/)
+  assert.doesNotMatch(message, /git credential-manager github login --device --force\s*;/)
+  assert.doesNotMatch(message, /--web/)
   assert.doesNotMatch(message, /PINOKIO_GITHUB_LOGIN_DONE/)
 })
 
@@ -76,7 +90,8 @@ test('GitHub login uses success-only credential verification on Windows', () =>
     kernel: { platform: 'win32' }
   })
 
-  assert.match(message, /git credential-manager github login --web --force && powershell\.exe -NoProfile -Command "\$env:GIT_TERMINAL_PROMPT='0'; \$env:GCM_INTERACTIVE='never'; @\('protocol=https','host=github\.com',''\) \| git credential fill > \$null; exit \$LASTEXITCODE" && echo P\^INOKIO_GITHUB_LOGIN_DONE/)
+  assert.match(message, /git credential-manager github login --device --force && powershell\.exe -NoProfile -Command "\$env:GIT_TERMINAL_PROMPT='0'; \$env:GCM_INTERACTIVE='never'; @\('protocol=https','host=github\.com',''\) \| git credential fill > \$null; exit \$LASTEXITCODE" && echo P\^INOKIO_GITHUB_LOGIN_DONE/)
+  assert.doesNotMatch(message, /--web/)
   assert.doesNotMatch(message, /PINOKIO_GITHUB_LOGIN_DONE/)
 })
 

package/test/huggingface-connect.test.js

@@ -5,6 +5,7 @@ const path = require('node:path')
 const test = require('node:test')
 
 const HuggingfaceConnect = require('../kernel/connect/providers/huggingface')
+const Environment = require('../kernel/environment')
 
 function createKernel(root) {
   return {
@@ -23,6 +24,11 @@ function createKernel(root) {
   }
 }
 
+test('system environment does not persist the default Hugging Face token path', async () => {
+  const content = await Environment.ENV('system', '/tmp/pinokio', {})
+  assert.doesNotMatch(content, /^HF_TOKEN_PATH=/m)
+})
+
 test('Hugging Face connect parses managed hf JSON device login events', () => {
   const provider = new HuggingfaceConnect(createKernel('/tmp/pinokio'), {})
   const parsed = provider.parseDeviceLogin(
@@ -72,6 +78,72 @@ test('Hugging Face connect uses shared HF_TOKEN_PATH and ignores ambient HF_TOKE
   }
 })
 
+test('Hugging Face connect verifies status with bounded whoami', async () => {
+  const provider = new HuggingfaceConnect(createKernel('/tmp/pinokio'), {})
+  let receivedArgs
+  let receivedOptions
+  provider.runHf = async (args, options) => {
+    receivedArgs = args
+    receivedOptions = options
+  }
+
+  const connected = await provider.connected({ timeout: 2500 })
+
+  assert.deepEqual(receivedArgs, ['auth', 'whoami', '--format', 'quiet'])
+  assert.deepEqual(receivedOptions, { timeout: 2500 })
+  assert.equal(connected, true)
+
+  provider.runHf = async () => {
+    throw new Error('not logged in')
+  }
+  assert.equal(await provider.connected({ timeout: 2500 }), false)
+})
+
+test('Hugging Face connect supplies the shared token path at runtime when it is not persisted', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-hf-connect-default-'))
+  await fs.writeFile(path.join(root, 'ENVIRONMENT'), 'OTHER=value\n')
+  try {
+    const provider = new HuggingfaceConnect(createKernel(root), {})
+    const env = await provider.authEnv()
+
+    assert.equal(env.HF_TOKEN_PATH, path.join(root, 'cache', 'HF_AUTH', 'token'))
+    await assert.doesNotReject(fs.access(path.join(root, 'cache', 'HF_AUTH')))
+    await assert.rejects(fs.access(env.HF_TOKEN_PATH), { code: 'ENOENT' })
+  } finally {
+    await fs.rm(root, { recursive: true, force: true })
+  }
+})
+
+test('Hugging Face connect repairs an empty directory at the token file path', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-hf-connect-repair-'))
+  const tokenPath = path.join(root, 'cache', 'HF_AUTH', 'token')
+  await fs.mkdir(tokenPath, { recursive: true })
+  try {
+    const provider = new HuggingfaceConnect(createKernel(root), {})
+    const env = await provider.authEnv()
+
+    assert.equal(env.HF_TOKEN_PATH, tokenPath)
+    await assert.rejects(fs.access(tokenPath), { code: 'ENOENT' })
+  } finally {
+    await fs.rm(root, { recursive: true, force: true })
+  }
+})
+
+test('Hugging Face connect preserves and rejects a non-empty token directory', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-hf-connect-invalid-'))
+  const tokenPath = path.join(root, 'cache', 'HF_AUTH', 'token')
+  await fs.mkdir(tokenPath, { recursive: true })
+  await fs.writeFile(path.join(tokenPath, 'keep.txt'), 'keep')
+  try {
+    const provider = new HuggingfaceConnect(createKernel(root), {})
+
+    await assert.rejects(provider.authEnv(), /Hugging Face token path must be a file/)
+    assert.equal(await fs.readFile(path.join(tokenPath, 'keep.txt'), 'utf8'), 'keep')
+  } finally {
+    await fs.rm(root, { recursive: true, force: true })
+  }
+})
+
 test('Hugging Face connect cancelLogin only stops a pending login session', async () => {
   const provider = new HuggingfaceConnect(createKernel('/tmp/pinokio'), {})
   let killed = false