pinokiod 8.0.30 → 8.0.32

package/kernel/bin/conda-meta.js

@@ -1,6 +1,7 @@
 const fs = require('fs')
 const path = require('path')
 const { execFile } = require('child_process')
+const { managedPythonEnv } = require('../python_env')
 
 async function buildCondaListFromMeta(minicondaPath, useCondaList) {
   if (!useCondaList) {
@@ -59,7 +60,10 @@ async function runCondaList(minicondaPath) {
     return { response: '', source: 'conda-list' }
   }
   return await new Promise((resolve) => {
-    execFile(condaBinary, ['list'], { windowsHide: true }, (err, stdout) => {
+    execFile(condaBinary, ['list'], {
+      env: managedPythonEnv(),
+      windowsHide: true,
+    }, (err, stdout) => {
       if (err) {
         resolve({ response: '', source: 'conda-list' })
       } else {
@@ -75,7 +79,11 @@ async function managedCondaRuns(minicondaPath, platform = process.platform) {
     return false
   }
   return await new Promise((resolve) => {
-    execFile(condaBinary, ['--version'], { windowsHide: true, timeout: 15000 }, (err) => {
+    execFile(condaBinary, ['--version'], {
+      env: managedPythonEnv(),
+      windowsHide: true,
+      timeout: 15000,
+    }, (err) => {
       resolve(!err)
     })
   })

package/kernel/connect/providers/huggingface/index.js

@@ -3,6 +3,7 @@ const fs = require('fs')
 const path = require('path')
 const fetch = require('cross-fetch')
 const Environment = require('../../../environment')
+const { managedPythonEnv } = require('../../../python_env')
 
 const stripAnsi = (value) => String(value || "").replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, "")
 
@@ -56,6 +57,7 @@ class Huggingface {
     if (context.env && typeof context.env === "object") {
       env = Object.assign(env, context.env)
     }
+    env = managedPythonEnv(env)
     if (!env.HF_TOKEN_PATH) {
       env.HF_TOKEN_PATH = this.defaultTokenPath()
     } else if (!path.isAbsolute(env.HF_TOKEN_PATH)) {

package/kernel/plugin_sources.js

@@ -16,6 +16,8 @@ const FUNCTION_KEYS = new Set([...ACTION_KEYS, ...STATUS_KEYS])
 const BUILTIN_TOOL_ALIASES = {
   claude: "pinokio/run/plugin/claude",
   codex: "pinokio/run/plugin/codex",
+  grok: "pinokio/run/plugin/grok",
+  "grok-build": "pinokio/run/plugin/grok",
   antigravity: "pinokio/run/plugin/antigravity-cli",
   "antigravity-cli": "pinokio/run/plugin/antigravity-cli",
   "code/claude": "pinokio/run/plugin/claude",

package/kernel/python_env.js

@@ -0,0 +1,14 @@
+function managedPythonEnv(source = process.env) {
+  const env = { ...(source || {}) }
+  for (const key of Object.keys(env)) {
+    if (["PYTHONNOUSERSITE", "PYTHONPATH"].includes(key.toUpperCase())) {
+      delete env[key]
+    }
+  }
+  env.PYTHONNOUSERSITE = "1"
+  return env
+}
+
+module.exports = {
+  managedPythonEnv,
+}

package/kernel/util.js

@@ -13,6 +13,7 @@ const child_process = require('node:child_process');
 const {auto: normalizeEOL} = require("eol");
 const {EOL} = require("os");
 const { randomUUID } = require('crypto');
+const { managedPythonEnv } = require('./python_env')
 const fsp = fs.promises;
 const breakPattern = /\n/g;
 const breakReplacement = "\\n";
@@ -203,7 +204,9 @@ const filepicker = async(req, ondata, kernel) => {
     } else {
       python = kernel.path("bin/miniforge/bin/python")
     }
-    const proc = spawn(python, [picker_path])
+    const proc = spawn(python, [picker_path], {
+      env: managedPythonEnv(),
+    })
 
     let output = "";
     proc.stdout.on("data", (chunk) => output += chunk);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.0.30",
+  "version": "8.0.32",
   "description": "",
   "main": "index.js",
   "scripts": {

package/system/plugin/grok/pinokio.js

@@ -0,0 +1,44 @@
+module.exports = {
+  title: "Grok Build",
+  icon: "grok.png",
+  link: "https://github.com/xai-org/grok-build",
+  run: [{
+    when: "{{platform === 'win32'}}",
+    id: "run",
+    method: "shell.run",
+    params: {
+      shell: "{{kernel.path('bin/miniforge/Library/bin/bash.exe')}}",
+      conda: {
+        skip: true
+      },
+      message: {
+        _: [
+          "npx",
+          "-y",
+          "@xai-official/grok@latest",
+          "{{args.prompt || undefined}}"
+        ]
+      },
+      path: "{{args.cwd}}",
+      input: true,
+      buffer: 1024
+    }
+  }, {
+    when: "{{platform !== 'win32'}}",
+    id: "run",
+    method: "shell.run",
+    params: {
+      message: {
+        _: [
+          "npx",
+          "-y",
+          "@xai-official/grok@latest",
+          "{{args.prompt || undefined}}"
+        ]
+      },
+      path: "{{args.cwd}}",
+      input: true,
+      buffer: 1024
+    }
+  }]
+}

package/system/plugin/grok-auto/pinokio.js

@@ -0,0 +1,20 @@
+const grok = require("../grok/pinokio")
+
+module.exports = {
+  ...grok,
+  title: "Grok Build Auto",
+  description: "Grok Build with tool permission prompts automatically approved unless explicitly denied.",
+  run: grok.run.map((step) => ({
+    ...step,
+    params: {
+      ...step.params,
+      message: {
+        _: [
+          ...step.params.message._.slice(0, 3),
+          "--always-approve",
+          ...step.params.message._.slice(3)
+        ]
+      }
+    }
+  }))
+}

package/test/conda-bin.test.js

@@ -1,4 +1,5 @@
 const assert = require('node:assert/strict')
+const childProcess = require('node:child_process')
 const fsModule = require('node:fs')
 const fs = require('node:fs/promises')
 const os = require('node:os')
@@ -75,6 +76,14 @@ async function createLegacyMiniconda(root) {
   return createCondaRoot(root, 'miniconda')
 }
 
+function restoreEnv(name, value) {
+  if (typeof value === 'undefined') {
+    delete process.env[name]
+  } else {
+    process.env[name] = value
+  }
+}
+
 function createConda(kernel) {
   const conda = new Conda()
   conda.kernel = kernel
@@ -94,6 +103,58 @@ function createBin(root, platform = 'win32') {
   return bin
 }
 
+test('managed Conda subprocesses ignore external Python packages', async (t) => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-python-env-'))
+  const platform = process.platform === 'win32' ? 'win32' : process.platform
+  const miniforge = path.join(root, 'bin', 'miniforge')
+  const versionCapture = path.join(root, 'version-env.json')
+  const listCapture = path.join(root, 'list-env.json')
+  const oldCapturePath = process.env.PINOKIO_TEST_ENV_CAPTURE
+  const oldNoUserSite = process.env.PYTHONNOUSERSITE
+  const oldPythonPath = process.env.PYTHONPATH
+
+  await writeFakeManagedConda(root, platform)
+  const condaMetaPath = require.resolve('../kernel/bin/conda-meta')
+  const realExecFile = childProcess.execFile.bind(childProcess)
+  delete require.cache[condaMetaPath]
+  t.mock.method(childProcess, 'execFile', (_binary, _args, options, done) => {
+    return realExecFile(process.execPath, [
+      '-e',
+      `require('node:fs').writeFileSync(process.env.PINOKIO_TEST_ENV_CAPTURE, JSON.stringify({
+        pythonNoUserSite: process.env.PYTHONNOUSERSITE,
+        pythonPath: process.env.PYTHONPATH || null
+      }))`,
+    ], options, done)
+  })
+  t.after(() => {
+    delete require.cache[condaMetaPath]
+  })
+  const { buildCondaListFromMeta, managedCondaRuns } = require('../kernel/bin/conda-meta')
+
+  process.env.PYTHONNOUSERSITE = '0'
+  process.env.PYTHONPATH = 'external-packages'
+  try {
+    process.env.PINOKIO_TEST_ENV_CAPTURE = versionCapture
+    assert.equal(await managedCondaRuns(miniforge, platform), true)
+    assert.deepEqual(JSON.parse(await fs.readFile(versionCapture, 'utf8')), {
+      pythonNoUserSite: '1',
+      pythonPath: null,
+    })
+
+    process.env.PINOKIO_TEST_ENV_CAPTURE = listCapture
+    await buildCondaListFromMeta(miniforge, true)
+    assert.deepEqual(JSON.parse(await fs.readFile(listCapture, 'utf8')), {
+      pythonNoUserSite: '1',
+      pythonPath: null,
+    })
+  } finally {
+    restoreEnv('PINOKIO_TEST_ENV_CAPTURE', oldCapturePath)
+    restoreEnv('PYTHONNOUSERSITE', oldNoUserSite)
+    restoreEnv('PYTHONPATH', oldPythonPath)
+    await fs.rm(root, { recursive: true, force: true })
+  }
+})
+
 test('Conda uses Miniforge assets and writes conda-forge-only config', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-miniforge-config-'))
   const conda = createConda(createKernel(root))

package/test/filepicker-python-env.test.js

@@ -0,0 +1,55 @@
+const assert = require('node:assert/strict')
+const fs = require('node:fs/promises')
+const os = require('node:os')
+const path = require('node:path')
+const test = require('node:test')
+
+const Util = require('../kernel/util')
+
+function restoreEnv(name, value) {
+  if (typeof value === 'undefined') {
+    delete process.env[name]
+  } else {
+    process.env[name] = value
+  }
+}
+
+test('file picker isolates its managed Python from external packages', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-filepicker-python-env-'))
+  const pickerPath = path.join(root, 'picker.js')
+  const oldNoUserSite = process.env.PYTHONNOUSERSITE
+  const oldPythonPath = process.env.PYTHONPATH
+  await fs.writeFile(pickerPath, `
+let input = ''
+process.stdin.setEncoding('utf8')
+process.stdin.on('data', (chunk) => { input += chunk })
+process.stdin.on('end', () => {
+  JSON.parse(input)
+  process.stdout.write(JSON.stringify({
+    paths: [process.env.PYTHONNOUSERSITE, process.env.PYTHONPATH || null]
+  }))
+})
+`)
+
+  process.env.PYTHONNOUSERSITE = '0'
+  process.env.PYTHONPATH = 'external-packages'
+  try {
+    const kernel = {
+      platform: 'linux',
+      path: (target) => {
+        if (target === 'bin/py/picker.py') return pickerPath
+        if (target === 'bin/miniforge/bin/python') return process.execPath
+        throw new Error(`Unexpected path: ${target}`)
+      },
+    }
+    const result = await Util.filepicker({ params: {} }, () => {}, kernel)
+
+    assert.deepEqual(result, {
+      paths: ['1', null],
+    })
+  } finally {
+    restoreEnv('PYTHONNOUSERSITE', oldNoUserSite)
+    restoreEnv('PYTHONPATH', oldPythonPath)
+    await fs.rm(root, { recursive: true, force: true })
+  }
+})

package/test/grok-plugin.test.js

@@ -0,0 +1,78 @@
+const assert = require("node:assert/strict")
+const fs = require("node:fs")
+const path = require("node:path")
+const test = require("node:test")
+
+const grok = require("../system/plugin/grok/pinokio")
+const grokAuto = require("../system/plugin/grok-auto/pinokio")
+
+test("Grok Build exposes a minimal npx-backed terminal plugin", () => {
+  assert.equal(grok.title, "Grok Build")
+  assert.equal(grok.icon, "grok.png")
+  assert.equal(grok.link, "https://github.com/xai-org/grok-build")
+  assert.equal(fs.existsSync(path.join(__dirname, "..", "system", "plugin", "grok", grok.icon)), true)
+
+  for (const action of ["install", "update", "uninstall", "installed"]) {
+    assert.equal(Object.prototype.hasOwnProperty.call(grok, action), false)
+  }
+
+  assert.equal(grok.run.length, 2)
+  for (const step of grok.run) {
+    assert.equal(step.id, "run")
+    assert.equal(step.method, "shell.run")
+    assert.deepEqual(step.params.message, {
+      _: [
+        "npx",
+        "-y",
+        "@xai-official/grok@latest",
+        "{{args.prompt || undefined}}"
+      ]
+    })
+    assert.equal(step.params.path, "{{args.cwd}}")
+    assert.equal(step.params.input, true)
+    assert.equal(step.params.buffer, 1024)
+  }
+
+  assert.match(grok.run[0].when, /win32/)
+  assert.match(grok.run[0].params.shell, /bash\.exe/)
+  assert.equal(grok.run[0].params.conda.skip, true)
+  assert.equal(Object.prototype.hasOwnProperty.call(grok.run[1].params, "shell"), false)
+})
+
+test("Grok Build Auto shares the base wrapper and enables always-approve", () => {
+  assert.equal(grokAuto.title, "Grok Build Auto")
+  assert.equal(grokAuto.icon, grok.icon)
+  assert.equal(grokAuto.link, grok.link)
+  assert.match(grokAuto.description, /automatically approved/)
+  assert.equal(fs.existsSync(path.join(__dirname, "..", "system", "plugin", "grok-auto", grokAuto.icon)), true)
+
+  for (const action of ["install", "update", "uninstall", "installed"]) {
+    assert.equal(Object.prototype.hasOwnProperty.call(grokAuto, action), false)
+  }
+
+  assert.equal(grokAuto.run.length, grok.run.length)
+  for (let index = 0; index < grok.run.length; index += 1) {
+    const baseStep = grok.run[index]
+    const autoStep = grokAuto.run[index]
+
+    assert.equal(autoStep.when, baseStep.when)
+    assert.equal(autoStep.id, baseStep.id)
+    assert.equal(autoStep.method, baseStep.method)
+    assert.equal(autoStep.params.path, baseStep.params.path)
+    assert.equal(autoStep.params.input, baseStep.params.input)
+    assert.equal(autoStep.params.buffer, baseStep.params.buffer)
+    assert.equal(autoStep.params.shell, baseStep.params.shell)
+    assert.deepEqual(autoStep.params.conda, baseStep.params.conda)
+    assert.deepEqual(autoStep.params.message, {
+      _: [
+        "npx",
+        "-y",
+        "@xai-official/grok@latest",
+        "--always-approve",
+        "{{args.prompt || undefined}}"
+      ]
+    })
+  }
+
+  assert.equal(grok.run.every((step) => !step.params.message._.includes("--always-approve")), true)
+})

package/test/huggingface-connect.test.js

@@ -79,6 +79,41 @@ test('Hugging Face connect preserves configured HF paths and ignores ambient HF_
   }
 })
 
+test('Hugging Face connect isolates its managed Python from external packages', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-hf-connect-python-env-'))
+  const childEnvPath = path.join(root, 'child-env.json')
+  await fs.writeFile(
+    path.join(root, 'ENVIRONMENT'),
+    'PYTHONNOUSERSITE=0\nPYTHONPATH=system-packages\n'
+  )
+  try {
+    const provider = new HuggingfaceConnect(createKernel(root), {})
+    provider.hfPath = () => process.execPath
+    const { env } = await provider.runHf([
+      '-e',
+      'require("node:fs").writeFileSync(process.argv[1], JSON.stringify({ pythonNoUserSite: process.env.PYTHONNOUSERSITE, pythonPath: process.env.PYTHONPATH || null }))',
+      childEnvPath
+    ], {}, {
+      env: {
+        PythonNoUserSite: '0',
+        PythonPath: 'command-packages'
+      }
+    })
+    const childEnv = JSON.parse(await fs.readFile(childEnvPath, 'utf8'))
+
+    assert.equal(env.PYTHONNOUSERSITE, '1')
+    assert.equal(env.PYTHONPATH, undefined)
+    assert.equal(env.PythonNoUserSite, undefined)
+    assert.equal(env.PythonPath, undefined)
+    assert.deepEqual(childEnv, {
+      pythonNoUserSite: '1',
+      pythonPath: null
+    })
+  } finally {
+    await fs.rm(root, { recursive: true, force: true })
+  }
+})
+
 test('Hugging Face connect uses the app token path for its managed CLI', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-hf-connect-app-env-'))
   const appDir = path.join(root, 'api', 'demo')

package/test/plugin-sources.test.js

@@ -18,6 +18,14 @@ test("resolveLauncherPluginSelection returns app-dev plugin query paths", () =>
     PluginSources.resolveLauncherPluginSelection("codex-auto"),
     "/plugin/codex-auto/pinokio.js"
   )
+  assert.strictEqual(
+    PluginSources.resolveLauncherPluginSelection("grok"),
+    "/pinokio/run/plugin/grok/pinokio.js"
+  )
+  assert.strictEqual(
+    PluginSources.resolveLauncherPluginSelection("grok-build"),
+    "/pinokio/run/plugin/grok/pinokio.js"
+  )
   assert.strictEqual(
     PluginSources.resolveLauncherPluginSelection("plugin/local-tool"),
     "/plugin/local-tool/pinokio.js"
@@ -208,10 +216,20 @@ module.exports = {
     const systemPlugins = menu.filter((item) => item.source === "system")
     const localPlugins = menu.filter((item) => item.source === "local")
 
-    assert.strictEqual(systemPlugins.length, 12)
+    assert.strictEqual(systemPlugins.length, 14)
     assert.ok(systemPlugins.every((item) => item.system === true))
     assert.ok(systemPlugins.every((item) => item.href.startsWith("/pinokio/run/plugin/")))
     assert.ok(systemPlugins.every((item) => item.image.startsWith("/pinokio/asset/plugin/")))
+    assert.ok(systemPlugins.some((item) => (
+      item.title === "Grok Build" &&
+      item.href === "/pinokio/run/plugin/grok/pinokio.js" &&
+      item.image === "/pinokio/asset/plugin/grok/grok.png"
+    )))
+    assert.ok(systemPlugins.some((item) => (
+      item.title === "Grok Build Auto" &&
+      item.href === "/pinokio/run/plugin/grok-auto/pinokio.js" &&
+      item.image === "/pinokio/asset/plugin/grok-auto/grok.png"
+    )))
 
     assert.deepStrictEqual(localPlugins.map((item) => item.title), ["Local Tool"])
     assert.strictEqual(localPlugins[0].href, "/run/plugin/local-tool/pinokio.js")