pinokiod 8.0.5 → 8.0.7

package/kernel/api/hf/index.js

@@ -168,6 +168,13 @@ class HF {
     }
     await this.htmlModal.close(this.modalRequest(req, this.modalId(req)), ondata, kernel)
   }
+  authContext(req = {}, params = {}) {
+    return {
+      parentPath: req.parent && req.parent.path,
+      cwd: req.cwd,
+      env: params.env,
+    }
+  }
   async cancelLogin(connect, params) {
     if (connect && typeof connect.cancelLogin === "function") {
       await connect.cancelLogin("huggingface", params || {})
@@ -201,9 +208,10 @@ class HF {
     const shouldWait = params.wait !== false
     const timeout = positiveNumber(params.timeout, 120000)
     const interval = positiveNumber(params.interval, 2000)
+    const authContext = this.authContext(req, params)
 
     if (!force) {
-      const existing = await connect.keys("huggingface")
+      const existing = await connect.keys("huggingface", authContext)
       if (existing && existing.access_token) {
         return {
           status: "success",
@@ -216,7 +224,7 @@ class HF {
     if (typeof connect.login !== "function") {
       throw new Error("Hugging Face connect login is not available")
     }
-    const response = await connect.login("huggingface", params)
+    const response = await connect.login("huggingface", params, authContext)
     if (!response || response.status === "error") {
       return response
     }
@@ -262,7 +270,7 @@ class HF {
 
     const startedAt = Date.now()
     while (Date.now() - startedAt < timeout) {
-      const keys = await connect.keys("huggingface")
+      const keys = await connect.keys("huggingface", authContext)
       if (keys && keys.access_token) {
         if (useModal) {
           await this.closeLoginModal(req, ondata, kernel)
@@ -293,7 +301,8 @@ class HF {
   */
   async logout(req, ondata, kernel) {
     const connect = this.connect(kernel, "logout")
-    await connect.logout("huggingface", req.params || {})
+    const params = req.params || {}
+    await connect.logout("huggingface", params, this.authContext(req, params))
     return { status: "success" }
   }
   /*

package/kernel/connect/index.js

@@ -24,12 +24,12 @@ class Connect {
       return null
     }
   }
-  async login(provider, req) {
-    let res = await this.clients[provider].login(req)
+  async login(provider, params, context) {
+    let res = await this.clients[provider].login(params, context)
     return res
   }
-  async logout(provider, req) {
-    let res = await this.clients[provider].logout(req)
+  async logout(provider, params, context) {
+    let res = await this.clients[provider].logout(params, context)
     return res
   }
   async cancelLogin(provider, req) {
@@ -38,8 +38,8 @@ class Connect {
     }
     return null
   }
-  async keys(provider) {
-    let res = await this.clients[provider].keys()
+  async keys(provider, context) {
+    let res = await this.clients[provider].keys(context)
     return res
   }
   async connected(provider, options) {

package/kernel/connect/providers/huggingface/index.js

@@ -18,30 +18,55 @@ class Huggingface {
   defaultTokenPath() {
     return this.kernel.path("cache", "HF_AUTH", "token")
   }
-  async authEnv() {
-    let systemEnv = {}
+  requestCwd(context = {}) {
+    if (context.cwd) {
+      return path.resolve(context.cwd)
+    }
+    if (context.parentPath) {
+      return path.dirname(path.resolve(context.parentPath))
+    }
+    return this.kernel.homedir
+  }
+  async repairTokenPath(tokenPath) {
     try {
-      systemEnv = await Environment.get(this.kernel.homedir, this.kernel)
-    } catch (_) {
-      systemEnv = {}
+      const stat = await fs.promises.lstat(tokenPath)
+      if (stat.isDirectory()) {
+        await fs.promises.rm(tokenPath, { recursive: true, force: true })
+      }
+    } catch (error) {
+      if (!error || error.code !== "ENOENT") {
+        throw error
+      }
+    }
+    await fs.promises.mkdir(path.dirname(tokenPath), { recursive: true })
+  }
+  async authEnv(context = {}) {
+    let env
+    if (context.parentPath) {
+      env = await Environment.get2(context.parentPath, this.kernel)
+    } else {
+      let systemEnv = {}
+      try {
+        systemEnv = await Environment.get(this.kernel.homedir, this.kernel)
+      } catch (_) {
+        systemEnv = {}
+      }
+      env = Object.assign({}, process.env, systemEnv)
+    }
+    if (context.env && typeof context.env === "object") {
+      env = Object.assign(env, context.env)
     }
-    const env = Object.assign({}, process.env, systemEnv)
     if (!env.HF_TOKEN_PATH) {
       env.HF_TOKEN_PATH = this.defaultTokenPath()
+    } else if (!path.isAbsolute(env.HF_TOKEN_PATH)) {
+      env.HF_TOKEN_PATH = path.resolve(this.requestCwd(context), env.HF_TOKEN_PATH)
     }
     if (!env.HF_HUB_DISABLE_UPDATE_CHECK) {
       env.HF_HUB_DISABLE_UPDATE_CHECK = "1"
     }
     delete env.HF_TOKEN
     delete env.HUGGING_FACE_HUB_TOKEN
-    try {
-      await fs.promises.rmdir(env.HF_TOKEN_PATH)
-    } catch (error) {
-      if (!error || !["ENOENT", "ENOTDIR"].includes(error.code)) {
-        throw new Error(`Hugging Face token path must be a file: ${env.HF_TOKEN_PATH}`)
-      }
-    }
-    await fs.promises.mkdir(path.dirname(env.HF_TOKEN_PATH), { recursive: true }).catch(() => {})
+    await this.repairTokenPath(env.HF_TOKEN_PATH)
     return env
   }
   hfPath() {
@@ -59,11 +84,11 @@ class Huggingface {
     }
     return candidates[0]
   }
-  async runHf(args, options = {}) {
-    const env = await this.authEnv()
+  async runHf(args, options = {}, context = {}) {
+    const env = await this.authEnv(context)
     return new Promise((resolve, reject) => {
       execFile(this.hfPath(), args, {
-        cwd: this.kernel.homedir,
+        cwd: this.requestCwd(context),
         env,
         timeout: Number.isFinite(options.timeout) ? options.timeout : undefined,
         maxBuffer: 1024 * 1024,
@@ -122,11 +147,18 @@ class Huggingface {
       expires_in: expiresMatch ? Number(expiresMatch[1]) : null,
     }
   }
-  async login() {
+  async login(_params = {}, context = {}) {
+    const env = await this.authEnv(context)
     if (this.loginSession && this.loginSession.status === "pending") {
+      if (this.loginSession.tokenPath !== env.HF_TOKEN_PATH) {
+        return {
+          status: "error",
+          error: `A Hugging Face login is already pending for ${this.loginSession.tokenPath}`,
+          token_path: env.HF_TOKEN_PATH,
+        }
+      }
       return this.serializeLoginSession(this.loginSession)
     }
-    const env = await this.authEnv()
     const session = {
       status: "pending",
       login: null,
@@ -156,7 +188,7 @@ class Huggingface {
       }
     }
     const child = spawn(this.hfPath(), ["auth", "login", "--format", "agent", "--force"], {
-      cwd: this.kernel.homedir,
+      cwd: this.requestCwd(context),
       env,
       windowsHide: false,
     })
@@ -192,12 +224,15 @@ class Huggingface {
     }
     return this.serializeLoginSession(session)
   }
-  async keys() {
+  async keys(context = {}) {
     if (this.loginSession && this.loginSession.status === "pending") {
-      return this.serializeLoginSession(this.loginSession)
+      const env = await this.authEnv(context)
+      if (this.loginSession.tokenPath === env.HF_TOKEN_PATH) {
+        return this.serializeLoginSession(this.loginSession)
+      }
     }
     try {
-      const { stdout, env } = await this.runHf(["auth", "token", "--format", "quiet"])
+      const { stdout, env } = await this.runHf(["auth", "token", "--format", "quiet"], {}, context)
       const access_token = stripAnsi(stdout).trim().split(/\r?\n/).find(Boolean)
       if (!access_token) {
         return null
@@ -235,12 +270,12 @@ class Huggingface {
     await this.config.profile.cache(response, connectPath).catch(() => {})
     return this.config.profile.render(response)
   }
-  async destroy() {
+  async destroy(context = {}) {
     if (this.loginSession && this.loginSession.child && this.loginSession.status === "pending") {
       this.loginSession.child.kill()
     }
     this.loginSession = null
-    await this.runHf(["auth", "logout"]).catch(() => {})
+    await this.runHf(["auth", "logout"], {}, context).catch(() => {})
     await fs.promises.rm(this.kernel.path("connect", "huggingface"), { recursive: true, force: true }).catch(() => {})
   }
   async cancelLogin() {
@@ -257,8 +292,8 @@ class Huggingface {
       this.loginSession = null
     }
   }
-  async logout() {
-    await this.destroy()
+  async logout(_params = {}, context = {}) {
+    await this.destroy(context)
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.0.5",
+  "version": "8.0.7",
   "description": "",
   "main": "index.js",
   "scripts": {

package/server/index.js

@@ -1546,15 +1546,11 @@ class Server {
   github_login_params() {
     const doneMarker = "PINOKIO_GITHUB_LOGIN_DONE"
     const delimiter = this.kernel.platform === "win32" ? " && " : " ; "
-    const verifyCommand = this.kernel.platform === "win32"
-      ? "powershell.exe -NoProfile -Command \"$env:GIT_TERMINAL_PROMPT='0'; $env:GCM_INTERACTIVE='never'; @('protocol=https','host=github.com','') | git credential fill > $null; exit $LASTEXITCODE\""
-      : "printf 'protocol=https\\nhost=github.com\\n\\n' | GIT_TERMINAL_PROMPT=0 GCM_INTERACTIVE=never git credential fill >/dev/null"
     const doneCommand = this.kernel.platform === "win32"
       ? "echo P^INOKIO_GITHUB_LOGIN_DONE"
       : "(GCM_DONE=INOKIO_GITHUB_LOGIN_DONE; printf 'P%s\\n' \"$GCM_DONE\")"
     const loginCommand = [
       "git credential-manager github login --device --force",
-      verifyCommand,
       doneCommand
     ].join(" && ")
 

package/test/github-connection.test.js

@@ -73,24 +73,29 @@ test('GitHub connection coalesces only concurrent GCM checks', async () => {
   assert.equal(calls, 2)
 })
 
-test('GitHub login only emits completion marker after credential verification', () => {
-  const { doneMarker, message } = Server.prototype.github_login_params.call({
-    kernel: { platform: 'darwin' }
-  })
-
-  assert.equal(doneMarker, 'PINOKIO_GITHUB_LOGIN_DONE')
-  assert.match(message, /git credential-manager github login --device --force && printf 'protocol=https\\nhost=github\.com\\n\\n' \| GIT_TERMINAL_PROMPT=0 GCM_INTERACTIVE=never git credential fill >\/dev\/null && \(GCM_DONE=INOKIO_GITHUB_LOGIN_DONE; printf 'P%s\\n' "\$GCM_DONE"\)/)
-  assert.doesNotMatch(message, /git credential-manager github login --device --force\s*;/)
-  assert.doesNotMatch(message, /--web/)
-  assert.doesNotMatch(message, /PINOKIO_GITHUB_LOGIN_DONE/)
+test('GitHub login completes directly from GCM success on macOS and Linux', () => {
+  for (const platform of ['darwin', 'linux']) {
+    const { doneMarker, message } = Server.prototype.github_login_params.call({
+      kernel: { platform }
+    })
+
+    assert.equal(doneMarker, 'PINOKIO_GITHUB_LOGIN_DONE')
+    assert.match(message, /git credential-manager github login --device --force && \(GCM_DONE=INOKIO_GITHUB_LOGIN_DONE; printf 'P%s\\n' "\$GCM_DONE"\)/)
+    assert.doesNotMatch(message, /credential fill/)
+    assert.doesNotMatch(message, /git credential-manager github login --device --force\s*;/)
+    assert.doesNotMatch(message, /--web/)
+    assert.doesNotMatch(message, /PINOKIO_GITHUB_LOGIN_DONE/)
+  }
 })
 
-test('GitHub login uses success-only credential verification on Windows', () => {
+test('GitHub login completes directly from GCM success on Windows', () => {
   const { message } = Server.prototype.github_login_params.call({
     kernel: { platform: 'win32' }
   })
 
-  assert.match(message, /git credential-manager github login --device --force && powershell\.exe -NoProfile -Command "\$env:GIT_TERMINAL_PROMPT='0'; \$env:GCM_INTERACTIVE='never'; @\('protocol=https','host=github\.com',''\) \| git credential fill > \$null; exit \$LASTEXITCODE" && echo P\^INOKIO_GITHUB_LOGIN_DONE/)
+  assert.match(message, /git credential-manager github login --device --force && echo P\^INOKIO_GITHUB_LOGIN_DONE/)
+  assert.doesNotMatch(message, /credential fill/)
+  assert.doesNotMatch(message, /powershell\.exe/)
   assert.doesNotMatch(message, /--web/)
   assert.doesNotMatch(message, /PINOKIO_GITHUB_LOGIN_DONE/)
 })

package/test/hf-api.test.js

@@ -17,12 +17,14 @@ test('hf.login shows a modal, waits for the user to open Hugging Face, then clos
   const originalOpenURI = Util.openURI
   const originalClipboard = Util.clipboard
   let keyReads = 0
+  const keyContexts = []
   const loginCalls = []
   const waitCalls = []
   const kernel = {
     connect: {
-      async keys(provider) {
+      async keys(provider, context) {
         assert.equal(provider, 'huggingface')
+        keyContexts.push(context)
         keyReads += 1
         if (keyReads < 3) {
           return null
@@ -32,8 +34,8 @@ test('hf.login shows a modal, waits for the user to open Hugging Face, then clos
           token_path: '/tmp/pinokio/hf-token'
         }
       },
-      async login(provider, params) {
-        loginCalls.push({ provider, params })
+      async login(provider, params, context) {
+        loginCalls.push({ provider, params, context })
         return {
           status: 'pending',
           login,
@@ -58,15 +60,28 @@ test('hf.login shows a modal, waits for the user to open Hugging Face, then clos
   }
 
   try {
-    const result = await hf.login({
+    const request = {
       parent: { id: 'test-script', path: '/pinokio/api/test/hf-login.js' },
       params: {
         timeout: 100,
         interval: 1
       }
-    }, (stream, type) => packets.push({ type, stream }), kernel)
+    }
+    const result = await hf.login(request, (stream, type) => packets.push({ type, stream }), kernel)
 
-    assert.deepEqual(loginCalls, [{ provider: 'huggingface', params: { timeout: 100, interval: 1 } }])
+    const authContext = {
+      parentPath: '/pinokio/api/test/hf-login.js',
+      cwd: undefined,
+      env: undefined
+    }
+    assert.deepEqual(loginCalls, [{
+      provider: 'huggingface',
+      params: request.params,
+      context: authContext
+    }])
+    assert.equal(loginCalls[0].params, request.params)
+    assert.equal(keyContexts.length, 3)
+    assert.equal(keyContexts.every((context) => context === loginCalls[0].context), true)
     assert.deepEqual(waitCalls, ['/pinokio/api/test/hf-login.js'])
     assert.deepEqual(actions, [{
       type: 'clipboard',
@@ -185,9 +200,14 @@ test('hf.login can use the non-modal browser fallback when modal is disabled', a
         assert.equal(provider, 'huggingface')
         return null
       },
-      async login(provider, params) {
+      async login(provider, params, context) {
         assert.equal(provider, 'huggingface')
         assert.deepEqual(params, { modal: false, wait: false })
+        assert.deepEqual(context, {
+          parentPath: undefined,
+          cwd: undefined,
+          env: undefined
+        })
         return {
           status: 'pending',
           login,
@@ -396,8 +416,8 @@ test('hf.logout delegates to the Hugging Face connect provider and returns succe
   const calls = []
   const kernel = {
     connect: {
-      async logout(provider, params) {
-        calls.push({ method: 'logout', provider, params })
+      async logout(provider, params, context) {
+        calls.push({ method: 'logout', provider, params, context })
       }
     }
   }
@@ -405,7 +425,16 @@ test('hf.logout delegates to the Hugging Face connect provider and returns succe
   const result = await hf.logout(req, () => {}, kernel)
 
   assert.deepEqual(result, { status: 'success' })
-  assert.deepEqual(calls, [{ method: 'logout', provider: 'huggingface', params: req.params }])
+  assert.deepEqual(calls, [{
+    method: 'logout',
+    provider: 'huggingface',
+    params: req.params,
+    context: {
+      parentPath: undefined,
+      cwd: undefined,
+      env: undefined
+    }
+  }])
 })
 
 test('hf.upload runs hf upload through shell.run with Hugging Face CLI args', async () => {

package/test/huggingface-connect.test.js

@@ -56,15 +56,16 @@ test('Hugging Face connect parses managed hf agent login instructions', () => {
   })
 })
 
-test('Hugging Face connect uses shared HF_TOKEN_PATH and ignores ambient HF_TOKEN', async () => {
+test('Hugging Face connect preserves configured HF paths and ignores ambient HF_TOKEN', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-hf-connect-'))
-  await fs.writeFile(path.join(root, 'ENVIRONMENT'), 'HF_TOKEN_PATH=./custom/hf-token\n')
+  await fs.writeFile(path.join(root, 'ENVIRONMENT'), 'HF_HOME=./custom/hf-home\nHF_TOKEN_PATH=./custom/hf-token\n')
   const oldToken = process.env.HF_TOKEN
   process.env.HF_TOKEN = 'hf_should_not_win'
   try {
     const provider = new HuggingfaceConnect(createKernel(root), {})
     const env = await provider.authEnv()
 
+    assert.equal(env.HF_HOME, path.join(root, 'custom', 'hf-home'))
     assert.equal(env.HF_TOKEN_PATH, path.join(root, 'custom', 'hf-token'))
     assert.equal(env.HF_TOKEN, undefined)
     assert.equal(env.HF_HUB_DISABLE_UPDATE_CHECK, '1')
@@ -78,6 +79,63 @@ test('Hugging Face connect uses shared HF_TOKEN_PATH and ignores ambient HF_TOKE
   }
 })
 
+test('Hugging Face connect uses the app token path for its managed CLI', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-hf-connect-app-env-'))
+  const appDir = path.join(root, 'api', 'demo')
+  const scriptPath = path.join(appDir, 'start.js')
+  const tokenPath = path.join(appDir, 'auth', 'token')
+  await fs.mkdir(appDir, { recursive: true })
+  await fs.writeFile(scriptPath, '')
+  await fs.writeFile(
+    path.join(appDir, 'ENVIRONMENT'),
+    'HF_HOME=./cache/huggingface\n'
+  )
+  try {
+    const provider = new HuggingfaceConnect(createKernel(root), {})
+    const context = {
+      parentPath: scriptPath,
+      cwd: appDir,
+    }
+    const sharedEnv = await provider.authEnv(context)
+    assert.equal(sharedEnv.HF_HOME, path.join(appDir, 'cache', 'huggingface'))
+    assert.equal(sharedEnv.HF_TOKEN_PATH, path.join(root, 'cache', 'HF_AUTH', 'token'))
+
+    await fs.writeFile(
+      path.join(appDir, 'ENVIRONMENT'),
+      'HF_HOME=./cache/huggingface\nHF_TOKEN_PATH=./auth/token\n'
+    )
+    provider.hfPath = () => process.execPath
+    const { env } = await provider.runHf([
+      '-e',
+      'require("node:fs").writeFileSync(process.env.HF_TOKEN_PATH, "hf_app_token")'
+    ], {}, context)
+
+    assert.equal(env.HF_HOME, path.join(appDir, 'cache', 'huggingface'))
+    assert.equal(env.HF_TOKEN_PATH, tokenPath)
+    assert.equal(await fs.readFile(tokenPath, 'utf8'), 'hf_app_token')
+    await assert.rejects(
+      fs.access(path.join(root, 'cache', 'HF_AUTH', 'token')),
+      { code: 'ENOENT' }
+    )
+
+    const commandTokenPath = path.join(appDir, 'command-auth', 'token')
+    const commandContext = {
+      parentPath: scriptPath,
+      cwd: appDir,
+      env: { HF_TOKEN_PATH: './command-auth/token' }
+    }
+    const commandResult = await provider.runHf([
+      '-e',
+      'require("node:fs").writeFileSync(process.env.HF_TOKEN_PATH, "hf_command_token")'
+    ], {}, commandContext)
+
+    assert.equal(commandResult.env.HF_TOKEN_PATH, commandTokenPath)
+    assert.equal(await fs.readFile(commandTokenPath, 'utf8'), 'hf_command_token')
+  } finally {
+    await fs.rm(root, { recursive: true, force: true })
+  }
+})
+
 test('Hugging Face connect verifies status with bounded whoami', async () => {
   const provider = new HuggingfaceConnect(createKernel('/tmp/pinokio'), {})
   let receivedArgs
@@ -99,7 +157,7 @@ test('Hugging Face connect verifies status with bounded whoami', async () => {
   assert.equal(await provider.connected({ timeout: 2500 }), false)
 })
 
-test('Hugging Face connect supplies the shared token path at runtime when it is not persisted', async () => {
+test('Hugging Face connect supplies the shared token path when none is configured', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-hf-connect-default-'))
   await fs.writeFile(path.join(root, 'ENVIRONMENT'), 'OTHER=value\n')
   try {
@@ -129,16 +187,43 @@ test('Hugging Face connect repairs an empty directory at the token file path', a
   }
 })
 
-test('Hugging Face connect preserves and rejects a non-empty token directory', async () => {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-hf-connect-invalid-'))
-  const tokenPath = path.join(root, 'cache', 'HF_AUTH', 'token')
+test('Hugging Face connect leaves existing token and refresh files unchanged', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-hf-connect-existing-login-'))
+  const authDir = path.join(root, 'cache', 'HF_AUTH')
+  await fs.mkdir(authDir, { recursive: true })
+  await fs.writeFile(path.join(authDir, 'token'), 'hf_existing_token')
+  await fs.writeFile(path.join(authDir, 'stored_tokens'), 'existing stored tokens')
+  try {
+    const provider = new HuggingfaceConnect(createKernel(root), {})
+    const env = await provider.authEnv()
+
+    assert.equal(env.HF_TOKEN_PATH, path.join(authDir, 'token'))
+    assert.equal(await fs.readFile(path.join(authDir, 'token'), 'utf8'), 'hf_existing_token')
+    assert.equal(await fs.readFile(path.join(authDir, 'stored_tokens'), 'utf8'), 'existing stored tokens')
+  } finally {
+    await fs.rm(root, { recursive: true, force: true })
+  }
+})
+
+test('Hugging Face connect removes a non-empty token directory', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-hf-connect-invalid-dir-'))
+  const authDir = path.join(root, 'cache', 'HF_AUTH')
+  const tokenPath = path.join(authDir, 'token')
   await fs.mkdir(tokenPath, { recursive: true })
-  await fs.writeFile(path.join(tokenPath, 'keep.txt'), 'keep')
+  await fs.writeFile(path.join(tokenPath, 'leftover.txt'), 'leftover')
+  await fs.writeFile(path.join(authDir, 'stored_tokens'), 'refresh state')
   try {
     const provider = new HuggingfaceConnect(createKernel(root), {})
+    await Promise.all([provider.authEnv(), provider.authEnv()])
+    provider.hfPath = () => process.execPath
+    const { env } = await provider.runHf([
+      '-e',
+      'require("node:fs").writeFileSync(process.env.HF_TOKEN_PATH, "hf_replacement_token")'
+    ])
 
-    await assert.rejects(provider.authEnv(), /Hugging Face token path must be a file/)
-    assert.equal(await fs.readFile(path.join(tokenPath, 'keep.txt'), 'utf8'), 'keep')
+    assert.equal(env.HF_TOKEN_PATH, tokenPath)
+    assert.equal(await fs.readFile(tokenPath, 'utf8'), 'hf_replacement_token')
+    assert.equal(await fs.readFile(path.join(authDir, 'stored_tokens'), 'utf8'), 'refresh state')
   } finally {
     await fs.rm(root, { recursive: true, force: true })
   }

package/test/shell-run-template.test.js

@@ -172,6 +172,39 @@ test('Shell.init_env disables Hugging Face hub update checks by default without
   assert.equal(overrideShell.env.HF_TOKEN_PATH, path.join(root, 'custom', 'hf-token'))
 })
 
+test('Shell.init_env preserves an app HF_HOME without changing the shared token default', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-shell-hf-app-env-'))
+  const appDir = path.join(root, 'api', 'demo')
+  const scriptPath = path.join(appDir, 'start.js')
+  await fs.mkdir(appDir, { recursive: true })
+  await fs.writeFile(scriptPath, '')
+  await fs.writeFile(path.join(appDir, 'ENVIRONMENT'), 'HF_HOME=./cache/huggingface\n')
+
+  const shell = createShell(createKernel(root))
+  await shell.init_env({
+    path: appDir,
+    $parent: { path: scriptPath },
+    env: {}
+  })
+
+  assert.equal(shell.env.HF_HOME, path.join(appDir, 'cache', 'huggingface'))
+  assert.equal(shell.env.HF_TOKEN_PATH, path.join(root, 'cache', 'HF_AUTH', 'token'))
+
+  await fs.writeFile(
+    path.join(appDir, 'ENVIRONMENT'),
+    'HF_HOME=./cache/huggingface\nHF_TOKEN_PATH=./auth/token\n'
+  )
+  const overrideShell = createShell(createKernel(root))
+  await overrideShell.init_env({
+    path: appDir,
+    $parent: { path: scriptPath },
+    env: {}
+  })
+
+  assert.equal(overrideShell.env.HF_HOME, path.join(appDir, 'cache', 'huggingface'))
+  assert.equal(overrideShell.env.HF_TOKEN_PATH, path.join(appDir, 'auth', 'token'))
+})
+
 test('Shell.init_env keeps Windows Hugging Face symlink defaults scoped to win32', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-shell-hf-win-'))
   await fs.mkdir(path.join(root, 'api'), { recursive: true })