pinokiod 8.2.10 → 8.2.11

package/test/conda-bin.test.js

@@ -16,7 +16,8 @@ const {
   isExpectedPythonPinned,
   TLS_PACKAGE_SPECS,
   PIP_MIN_VERSION,
-  PIP_INSTALL_COMMAND,
+  PIP_WHEEL,
+  PIP_SEED_SCRIPT,
 } = require('../kernel/bin/conda-pins')
 
 test.beforeEach(t => {
@@ -24,6 +25,12 @@ test.beforeEach(t => {
   t.mock.method(childProcess, 'execFile', (binary, args, options, done) => {
     if (args[0] !== '-I') return realExecFile(binary, args, options, done)
     const prefix = path.basename(binary) === 'python.exe' ? path.dirname(binary) : path.dirname(path.dirname(binary))
+    if (args.includes(PIP_SEED_SCRIPT)) {
+      const marker = path.join(prefix, 'test-pip-seed')
+      const operation = args.includes('--check') ? fs.readFile(marker, 'utf8') : fs.writeFile(marker, 'ready')
+      operation.then(() => done(null, ''), error => done(error, '', error.message))
+      return
+    }
     assert.deepEqual(args, ['-I', '-m', 'pip', '--version'])
     fs.readFile(path.join(prefix, 'test-pip-version'), 'utf8').then(
       version => done(null, `pip ${version.trim()} from ${prefix} (python 3.10)`), error => done(error, '')
@@ -73,6 +80,7 @@ async function writeHealthyCondaMeta(root, platform = 'win32', condaVersion = CO
     await writeCondaMeta(root, name, '2026.10.19')
   }
   await fs.writeFile(path.join(root, 'bin/miniforge/test-pip-version'), PIP_MIN_VERSION)
+  await fs.writeFile(path.join(root, 'bin/miniforge/test-pip-seed'), 'ready')
 }
 
 async function writeFakeManagedConda(root, platform = 'win32') {
@@ -112,6 +120,7 @@ function createConda(kernel) {
   const conda = new Conda()
   conda.kernel = kernel
   conda.verifyInstaller = async () => {} // Installer lifecycle tests mock the download.
+  conda.cachePipWheel = async () => kernel.bin.path(PIP_WHEEL.filename)
   return conda
 }
 
@@ -278,7 +287,7 @@ test('Conda install requests the Python 3.10.20 pin on macOS/Linux', async () =>
   assert.equal(await pathExists(path.join(root, 'bin', 'miniconda')), true)
   const condaInstall = calls.find((call) => Array.isArray(call.message))
   assert.ok(condaInstall)
-  assert.equal(condaInstall.message[2], PIP_INSTALL_COMMAND)
+  assert.deepEqual(condaInstall.message[2], { _: ['python', '-I', '-m', 'pip', '--isolated', 'install', '--no-index', PIP_WHEEL.filename] })
   assert.equal(
     condaInstall.message[1],
     'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
@@ -639,6 +648,7 @@ test('tampered Miniforge installers stop immediately and leave the runtime untou
   kernel.bin.mod = { caddy: { running: () => assert.fail('must verify before stopping services') } }
   const conda = new Conda()
   conda.kernel = kernel
+  conda.cachePipWheel = async () => kernel.bin.path(PIP_WHEEL.filename)
   await assert.rejects(conda.install({}, () => {}), /SHA-256 verification failed/)
   assert.equal(downloads, 1)
   assert.equal(await pathExists(path.join(root, 'bin/miniforge/Scripts/conda.exe')), true)
@@ -667,6 +677,9 @@ test('certificate refresh preserves named environments and existing configuratio
     const dir = path.join(root, platform)
     await writeHealthyCondaMeta(dir, platform)
     await writeFakeManagedConda(dir, platform)
+    for (const name of ['ca-certificates', 'certifi']) {
+      await fs.rm(path.join(dir, 'bin/miniforge/conda-meta', `${name}-2026.10.19.json`))
+    }
     await fs.writeFile(path.join(dir, 'bin/miniforge/test-pip-version'), '23.0.1')
     const marker = path.join(dir, 'bin/miniforge/envs/app/keep')
     await fs.mkdir(path.dirname(marker), { recursive: true })
@@ -690,16 +703,150 @@ test('certificate refresh preserves named environments and existing configuratio
     const python = platform === 'win32' ? WINDOWS_PYTHON_SSL_FIX_SPEC : PYTHON_INSTALL_SPEC
     assert.deepEqual(calls[0].message, [
       `conda install -y --override-channels -c conda-forge "${python}" "conda-libmamba-solver>=25.4.0" ${TLS_PACKAGE_SPECS.map(spec => `"${spec}"`).join(' ')}`,
-      PIP_INSTALL_COMMAND,
     ])
   }
 })
 
+test('a missing or old solver is repaired in place when TLS and pip are already current', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-solver-repair-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  for (const platform of ['darwin', 'win32', 'linux']) {
+    for (const version of [null, '24.9.0', '25.3.0']) {
+      const dir = path.join(root, platform, String(version))
+      await writeHealthyCondaMeta(dir, platform)
+      await writeFakeManagedConda(dir, platform)
+      await fs.rm(path.join(dir, 'bin/miniforge/conda-meta/conda-libmamba-solver-25.4.0.json'))
+      if (version) await writeCondaMeta(dir, 'conda-libmamba-solver', version)
+      const marker = path.join(dir, 'bin/miniforge/envs/app/keep')
+      await fs.mkdir(path.dirname(marker), { recursive: true })
+      await fs.writeFile(marker, 'existing app')
+      const kernel = createKernel(dir, platform)
+      let installs = 0
+      kernel.bin.download = async () => assert.fail('must not replace the runtime')
+      kernel.bin.exec = async ({ message }) => {
+        installs++
+        assert.match(message[0], /conda install -y --solver classic /)
+        assert.match(message[0], /"conda-libmamba-solver>=25\.4\.0"/)
+        if (version) await fs.rm(path.join(dir, `bin/miniforge/conda-meta/conda-libmamba-solver-${version}.json`))
+        await writeHealthyCondaMeta(dir, platform)
+        return {}
+      }
+      const conda = createConda(kernel)
+      assert.equal(await conda.check(), false)
+      await conda.install({}, () => {})
+      assert.equal(await conda.check(), true)
+      await conda.install({}, () => {})
+      assert.equal(installs, 1, 'a retry uses the repaired solver')
+      assert.equal(await fs.readFile(marker, 'utf8'), 'existing app')
+    }
+  }
+})
+
+test('in-place repair checks pip after Conda changes it and never downgrades newer pip', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-pip-refresh-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  for (const platform of ['darwin', 'win32', 'linux']) {
+    for (const [before, after] of [['27.0', '27.0'], ['27.0', '23.0.1'], ['23.0.1', '23.0.1'], ['23.0.1', '27.0']]) {
+      const dir = path.join(root, platform, before, after)
+      await writeHealthyCondaMeta(dir, platform)
+      await writeFakeManagedConda(dir, platform)
+      // Force a repair independently of the starting pip version.
+      await fs.rm(path.join(dir, 'bin/miniforge/conda-meta/conda-libmamba-solver-25.4.0.json'))
+      const version = path.join(dir, 'bin/miniforge/test-pip-version')
+      await fs.writeFile(version, before)
+      const marker = path.join(dir, 'bin/miniforge/envs/app/keep')
+      await fs.mkdir(path.dirname(marker), { recursive: true })
+      await fs.writeFile(marker, 'existing app')
+      const kernel = createKernel(dir, platform)
+      let pipInstalls = 0
+      kernel.bin.download = async () => assert.fail('must not replace the runtime')
+      kernel.bin.exec = async ({ message }) => {
+        if (Array.isArray(message)) {
+          assert.equal(message.length, 1, 'Conda repair must not include an unconditional pip install')
+          await writeHealthyCondaMeta(dir, platform)
+          await fs.writeFile(version, after)
+        } else {
+          pipInstalls++
+          assert.deepEqual(message, { _: ['python', '-I', '-m', 'pip', '--isolated', 'install', '--no-index', PIP_WHEEL.filename] })
+          await fs.writeFile(version, PIP_MIN_VERSION)
+        }
+        return {}
+      }
+      await createConda(kernel).install({}, () => {})
+      assert.equal(pipInstalls, after === '27.0' ? 0 : 1)
+      assert.equal(await fs.readFile(version, 'utf8'), after === '27.0' ? '27.0' : PIP_MIN_VERSION)
+      assert.equal(await fs.readFile(marker, 'utf8'), 'existing app')
+    }
+  }
+})
+
+test('old or missing pip is repaired without a Conda transaction when solver and certificates are current', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-pip-only-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  for (const platform of ['darwin', 'win32', 'linux']) {
+    for (const version of ['23.0.1', null]) {
+      const dir = path.join(root, platform, String(version))
+      await writeHealthyCondaMeta(dir, platform)
+      await writeFakeManagedConda(dir, platform)
+      const pip = path.join(dir, 'bin/miniforge/test-pip-version')
+      if (version) await fs.writeFile(pip, version)
+      else await fs.rm(pip)
+      const seed = path.join(dir, 'bin/miniforge/test-pip-seed')
+      await fs.rm(seed)
+      const marker = path.join(dir, 'bin/miniforge/envs/app/keep')
+      await fs.mkdir(path.dirname(marker), { recursive: true })
+      await fs.writeFile(marker, 'existing app')
+      const kernel = createKernel(dir, platform)
+      let installs = 0
+      kernel.bin.download = async () => assert.fail('must not replace the runtime')
+      kernel.bin.exec = async ({ message }) => {
+        installs++
+        assert.deepEqual(message, { _: ['python', '-I', '-m', 'pip', '--isolated', 'install', '--no-index', PIP_WHEEL.filename] })
+        await fs.writeFile(pip, PIP_MIN_VERSION)
+        return {}
+      }
+      const conda = createConda(kernel)
+      conda._install = async () => assert.fail('must not reinstall the runtime')
+      await conda.install({}, () => {})
+      assert.equal(installs, 1, 'only the verified pip wheel is installed')
+      assert.equal(await conda.check(), true)
+      assert.equal(await fs.readFile(seed, 'utf8'), 'ready')
+      assert.equal(await fs.readFile(marker, 'utf8'), 'existing app')
+    }
+  }
+})
+
+test('failed in-place pip repair preserves app environments and does not proceed to seed repair', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-pip-refresh-fail-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  await writeHealthyCondaMeta(root, 'darwin')
+  await writeFakeManagedConda(root, 'darwin')
+  const version = path.join(root, 'bin/miniforge/test-pip-version')
+  await fs.writeFile(version, '23.0.1')
+  const marker = path.join(root, 'bin/miniforge/envs/app/keep')
+  await fs.mkdir(path.dirname(marker), { recursive: true })
+  await fs.writeFile(marker, 'existing app')
+  const kernel = createKernel(root, 'darwin')
+  let calls = 0
+  kernel.bin.exec = async ({ message }) => {
+    calls++
+    assert.equal(Array.isArray(message), false, 'pip-only failure must not run Conda')
+    return { error: ['pip failed'] }
+  }
+  const conda = createConda(kernel)
+  conda.preparePipSeed = async () => assert.fail('a failed pip repair must stop setup')
+  conda._install = async () => assert.fail('must not replace the runtime')
+  await assert.rejects(conda.install({}, () => {}), /existing environments were preserved/)
+  assert.equal(calls, 1)
+  assert.equal(await fs.readFile(marker, 'utf8'), 'existing app')
+})
+
 test('failed refresh reports an error without falling back to runtime replacement', async t => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-ca-failed-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
   await writeHealthyCondaMeta(root, 'darwin')
   await writeFakeManagedConda(root, 'darwin')
+  await fs.rm(path.join(root, 'bin/miniforge/conda-meta/certifi-2026.10.19.json'))
   const marker = path.join(root, 'bin/miniforge/envs/app/keep')
   await fs.mkdir(path.dirname(marker), { recursive: true })
   await fs.writeFile(marker, 'preserve')
@@ -730,7 +877,7 @@ test('fresh installation retains readiness-based retries after package or pip er
       return {}
     }
     assert.deepEqual(payload.env, { PIP_REQUIRE_VIRTUALENV: 'false' })
-    assert.equal(payload.message[2], PIP_INSTALL_COMMAND)
+    assert.deepEqual(payload.message[2], { _: ['python', '-I', '-m', 'pip', '--isolated', 'install', '--no-index', PIP_WHEEL.filename] })
     if (attempts === 1) return { error: ['ERROR: pip download failed'] }
     await fs.writeFile(path.join(root, 'bin/miniforge/test-pip-version'), PIP_MIN_VERSION)
     return {}
@@ -741,6 +888,47 @@ test('fresh installation retains readiness-based retries after package or pip er
   assert.equal(await conda.check(), true)
 })
 
+test('post-install seed verification failure preserves the runtime and retries repair in place', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-post-install-seed-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  await fs.mkdir(path.join(root, 'bin'), { recursive: true })
+  const kernel = createKernel(root, 'darwin')
+  let downloads = 0
+  kernel.bin.mods = []
+  kernel.bin.download = async () => { downloads++ }
+  kernel.bin.rm = async () => {}
+  kernel.bin.exec = async payload => {
+    if (payload.conda?.skip) {
+      await writeHealthyCondaMeta(root, 'darwin')
+      await writeFakeManagedConda(root, 'darwin')
+    }
+    return {}
+  }
+  const conda = createConda(kernel)
+  const prepare = conda.preparePipSeed.bind(conda)
+  const marker = path.join(root, 'bin/miniforge/envs/app/keep')
+  let damaged = false
+  conda.preparePipSeed = async ondata => {
+    await prepare(ondata)
+    if (!damaged) {
+      damaged = true
+      await fs.mkdir(path.dirname(marker), { recursive: true })
+      await fs.writeFile(marker, 'preserve')
+      // Lose the seed after preparation, before the final readiness check.
+      await fs.rm(path.join(root, 'bin/miniforge/test-pip-seed'))
+    }
+  }
+  await assert.rejects(conda.install({}, () => {}), /pip seed verification failed; the runtime was preserved/)
+  assert.equal(downloads, 1)
+  assert.equal(await fs.readFile(marker, 'utf8'), 'preserve')
+  assert.equal(await conda.check(), false)
+  kernel.bin.exec = async () => assert.fail('retry must repair the seed without reinstalling the runtime')
+  await conda.install({}, () => {})
+  assert.equal(downloads, 1)
+  assert.equal(await fs.readFile(marker, 'utf8'), 'preserve')
+  assert.equal(await conda.check(), true)
+})
+
 test('pip readiness accepts two-part release versions through the actual pip CLI', async t => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-pip-release-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
@@ -754,3 +942,65 @@ test('pip readiness accepts two-part release versions through the actual pip CLI
     assert.equal(bin.correct_conda, true)
   }
 })
+
+test('pip wheel cache verifies downloads, reuses valid data and cleans failed attempts', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-pip-cache-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  await fs.mkdir(path.join(root, 'bin'))
+  const kernel = createKernel(root, 'darwin')
+  const conda = new Conda()
+  conda.kernel = kernel
+  const bytes = Buffer.from('test wheel')
+  const originalHash = PIP_WHEEL.sha256
+  PIP_WHEEL.sha256 = require('node:crypto').createHash('sha256').update(bytes).digest('hex')
+  t.after(() => { PIP_WHEEL.sha256 = originalHash })
+  const destination = kernel.bin.path(PIP_WHEEL.filename)
+  let downloads = 0
+  kernel.bin.download = async (url, name) => {
+    assert.equal(url, PIP_WHEEL.url)
+    downloads++
+    await fs.writeFile(kernel.bin.path(name), downloads === 1 ? 'bad download' : bytes)
+  }
+  await assert.rejects(conda.cachePipWheel(() => {}), /SHA-256 verification failed/)
+  assert.deepEqual(await fs.readdir(kernel.bin.path()), [])
+  assert.equal(await conda.cachePipWheel(() => {}), destination)
+  assert.equal(await conda.cachePipWheel(() => {}), destination)
+  assert.equal(downloads, 2)
+  await fs.writeFile(destination, 'damaged cache')
+  await Promise.all([conda.cachePipWheel(() => {}), conda.cachePipWheel(() => {})])
+  assert.deepEqual(await fs.readFile(destination), bytes)
+  assert.deepEqual(await fs.readdir(kernel.bin.path()), [PIP_WHEEL.filename])
+})
+
+test('seed-only damage and repair failure never reinstall Conda or delete app environments', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-seed-only-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  for (const platform of ['darwin', 'win32', 'linux']) {
+    const dir = path.join(root, platform)
+    await writeHealthyCondaMeta(dir, platform)
+    await writeFakeManagedConda(dir, platform)
+    await fs.rm(path.join(dir, 'bin/miniforge/test-pip-seed'))
+    const marker = path.join(dir, 'bin/miniforge/envs/app/keep')
+    await fs.mkdir(path.dirname(marker), { recursive: true })
+    await fs.writeFile(marker, 'preserve')
+    const kernel = createKernel(dir, platform)
+    kernel.bin.exec = async () => assert.fail('seed repair must not run Conda install')
+    kernel.bin.download = async () => assert.fail('seed repair must not download a runtime installer')
+    const conda = createConda(kernel)
+    const repair = conda.preparePipSeed.bind(conda)
+    assert.equal(await conda.check(), false)
+    const bin = createBin(dir, platform)
+    await bin.tryList()
+    assert.equal(bin.correct_conda, false)
+    conda.preparePipSeed = async () => { throw new Error('simulated seed repair failure') }
+    await assert.rejects(conda.install({}, () => {}), /simulated seed repair failure/)
+    assert.equal(await fs.readFile(marker, 'utf8'), 'preserve')
+    conda.preparePipSeed = repair
+    await conda.install({}, () => {})
+    assert.equal(await conda.check(), true)
+    assert.equal(await pathExists(path.join(dir, 'bin/miniconda')), true)
+    await bin.tryList()
+    assert.equal(bin.correct_conda, true)
+    assert.equal(await fs.readFile(marker, 'utf8'), 'preserve')
+  }
+})

package/test/pip_seed_test.py

@@ -0,0 +1,183 @@
+import hashlib
+import importlib.util
+import json
+import os
+from pathlib import Path
+import py_compile
+import stat
+import sys
+import tempfile
+import types
+import unittest
+from unittest.mock import patch
+import zipfile
+
+
+SCRIPT = Path(__file__).resolve().parents[1] / "system" / "repair_pip_seed.py"
+spec = importlib.util.spec_from_file_location("repair_pip_seed", SCRIPT)
+seed = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(seed)
+
+
+class PipSeedTests(unittest.TestCase):
+    def setUp(self):
+        self.temporary = tempfile.TemporaryDirectory(prefix="pip seed O'Brien & (test) ")
+        self.addCleanup(self.temporary.cleanup)
+        self.prefix = Path(self.temporary.name).resolve()
+        self.directory = self.prefix / "Lib" / "ensurepip"
+        self.bundled = self.directory / "_bundled"
+        self.bundled.mkdir(parents=True)
+        self.source = self.directory / "__init__.py"
+        self.original = b'_PIP_VERSION = "23.0.1"\n_SETUPTOOLS_VERSION = "79.0.1"\n'
+        self.source.write_bytes(self.original)
+        self.source.chmod(0o640 if os.name != "nt" else 0o666)
+        self.source_mode = stat.S_IMODE(self.source.stat().st_mode)
+        self.old_wheel = self.bundled / "pip-23.0.1-py3-none-any.whl"
+        self.old_wheel.write_bytes(b"old wheel stays")
+        self.setuptools = self.bundled / "setuptools-79.0.1.whl"
+        self.setuptools.write_bytes(b"keep setuptools")
+        self.legacy = self.prefix / "existing-venv" / "pip"
+        self.legacy.parent.mkdir()
+        self.legacy.write_bytes(b"existing pip stays")
+        self.pin = json.loads(SCRIPT.with_name("pip_seed.json").read_text())
+        self.wheel = self.prefix / self.pin["filename"]
+        self.wheel.write_bytes(b"verified fixture wheel")
+        self.pin["sha256"] = hashlib.sha256(self.wheel.read_bytes()).hexdigest()
+        self.destination = self.bundled / self.pin["filename"]
+        self.module = types.ModuleType("ensurepip")
+        self.module.__file__ = str(self.source)
+        self.module.version = lambda: self.source.read_text().split('"')[1]
+        for mock in [patch.object(sys, "prefix", str(self.prefix)),
+                     patch.object(sys, "base_prefix", str(self.prefix)),
+                     patch.dict(sys.modules, {"ensurepip": self.module}),
+                     patch("json.loads", return_value=self.pin)]:
+            mock.start()
+            self.addCleanup(mock.stop)
+
+    def repair(self, check=False):
+        seed.repair(str(self.wheel), str(self.prefix), check)
+
+    def test_hardlinks_permissions_packages_and_repeat(self):
+        alias = self.prefix / "conda-cache-source"
+        os.link(self.source, alias)
+        wheel_alias = self.prefix / "conda-cache-wheel"
+        self.destination.write_bytes(b"corrupt old destination")
+        os.link(self.destination, wheel_alias)
+        self.repair()
+        self.assertEqual(alias.read_bytes(), self.original)
+        self.assertEqual(wheel_alias.read_bytes(), b"corrupt old destination")
+        self.assertEqual(stat.S_IMODE(self.source.stat().st_mode), self.source_mode)
+        self.assertEqual(self.old_wheel.read_bytes(), b"old wheel stays")
+        self.assertEqual(self.setuptools.read_bytes(), b"keep setuptools")
+        self.assertEqual(self.legacy.read_bytes(), b"existing pip stays")
+        inode = self.source.stat().st_ino
+        self.repair()
+        self.assertEqual(self.source.stat().st_ino, inode)
+        self.repair(check=True)
+
+    def test_bad_download_changes_nothing(self):
+        self.wheel.write_bytes(b"bad download")
+        with self.assertRaisesRegex(RuntimeError, "SHA-256"):
+            self.repair()
+        self.assertEqual(self.source.read_bytes(), self.original)
+        self.assertFalse(self.destination.exists())
+
+    def test_interrupted_source_publish_is_retryable(self):
+        replace = os.replace
+
+        def interrupt(source, destination):
+            if Path(destination) == self.source:
+                raise PermissionError("simulated source replacement failure")
+            replace(source, destination)
+
+        with patch("os.replace", side_effect=interrupt):
+            with self.assertRaises(PermissionError):
+                self.repair()
+        self.assertEqual(self.source.read_bytes(), self.original)
+        self.assertEqual(self.destination.read_bytes(), self.wheel.read_bytes())
+        self.assertEqual(self.old_wheel.read_bytes(), b"old wheel stays")
+        self.assertEqual(sorted(p.name for p in self.directory.iterdir()), ["__init__.py", "_bundled"])
+        self.repair()
+        self.repair(check=True)
+
+    def test_readiness_detects_missing_and_corrupt_seed_and_cache(self):
+        self.repair()
+        for value in [None, b"corrupt seed"]:
+            if value is None:
+                self.destination.unlink()
+            else:
+                self.destination.write_bytes(value)
+            with self.assertRaises((RuntimeError, FileNotFoundError)):
+                self.repair(check=True)
+            self.repair()
+            self.repair(check=True)
+        self.wheel.unlink()
+        with self.assertRaises(FileNotFoundError):
+            self.repair(check=True)
+
+    def test_same_size_source_update_invalidates_bytecode(self):
+        cache = Path(py_compile.compile(str(self.source), doraise=True))
+        before = self.source.stat()
+        self.repair()
+        self.assertEqual(self.source.stat().st_size, before.st_size)
+        self.assertFalse(cache.exists())
+        self.assertEqual(self.module.version(), self.pin["version"])
+        # A Conda Python reinstall restores the old seed reference.
+        self.source.write_bytes(self.original)
+        with self.assertRaisesRegex(RuntimeError, "needs repair"):
+            self.repair(check=True)
+        self.repair()
+        self.repair(check=True)
+
+    def test_newer_seed_is_preserved_or_repaired_when_incomplete(self):
+        newer_source = self.original.replace(b"23.0.1", b"27.0")
+        self.source.write_bytes(newer_source)
+        newer = self.bundled / "pip-27.0-py3-none-any.whl"
+        with zipfile.ZipFile(newer, "w") as archive:
+            archive.writestr("pip/__init__.py", "__version__ = '27.0'")
+            archive.writestr("pip-27.0.dist-info/METADATA", "Name: pip\nVersion: 27.0\n")
+        before = newer.read_bytes()
+        self.repair()
+        self.repair(check=True)
+        self.assertEqual(self.source.read_bytes(), newer_source)
+        self.assertEqual(newer.read_bytes(), before)
+        self.assertFalse(self.destination.exists())
+        newer.unlink()
+        with self.assertRaisesRegex(RuntimeError, "needs repair"):
+            self.repair(check=True)
+        self.repair()
+        self.repair(check=True)
+
+    def test_unsupported_python_and_wrong_prefix_cannot_be_modified(self):
+        with patch.object(sys, "version_info", (3, 9, 0)):
+            self.repair()
+            with self.assertRaisesRegex(RuntimeError, "3.10"):
+                self.repair(check=True)
+        self.assertEqual(self.source.read_bytes(), self.original)
+        with self.assertRaisesRegex(RuntimeError, "selected Python prefix"):
+            seed.repair(str(self.wheel), str(self.prefix / "another"))
+        with patch.object(sys, "base_prefix", str(self.prefix / "another")):
+            with self.assertRaisesRegex(RuntimeError, "selected Python prefix"):
+                self.repair()
+        self.assertFalse(self.destination.exists())
+
+    def test_unrecognized_layout_is_rejected_without_changes(self):
+        self.source.write_bytes(b"# unexpected vendor layout\n")
+        with self.assertRaisesRegex(RuntimeError, "Unrecognized"):
+            self.repair()
+        self.assertFalse(self.destination.exists())
+
+    @unittest.skipIf(os.name == "nt", "directory symlinks may require Windows administrator rights")
+    def test_bundled_directory_cannot_redirect_writes_outside_the_prefix(self):
+        import shutil
+        with tempfile.TemporaryDirectory() as other:
+            shutil.rmtree(self.bundled)
+            self.bundled.symlink_to(other, target_is_directory=True)
+            with self.assertRaisesRegex(RuntimeError, "selected Python prefix"):
+                self.repair()
+            self.assertEqual(list(Path(other).iterdir()), [])
+            self.assertEqual(self.source.read_bytes(), self.original)
+
+
+if __name__ == "__main__":
+    unittest.main()