pinokiod 8.2.10 → 8.2.12

package/kernel/anywhere/ports.js

@@ -11,7 +11,7 @@
   to be free on the machine itself.
 */
 const fs = require('fs')
-const path = require('path')
+const writeJson = require('./state')
 
 const FIRST_PORT = 43000
 const LAST_PORT = 43999
@@ -19,17 +19,14 @@ const LAST_PORT = 43999
 async function loadPortMap(file) {
   try {
     const map = JSON.parse(await fs.promises.readFile(file, 'utf8'))
-    return map && typeof map === 'object' && !Array.isArray(map) ? map : {}
-  } catch (_) {
+    if (!map || typeof map !== 'object' || Array.isArray(map)) throw new Error('Invalid saved Anywhere port map')
+    return map
+  } catch (e) {
+    if (e.code !== 'ENOENT') throw e
     return {}
   }
 }
 
-async function savePortMap(file, map) {
-  await fs.promises.mkdir(path.dirname(file), { recursive: true })
-  await fs.promises.writeFile(file, JSON.stringify(map, null, 2))
-}
-
 // Returns a copy of `map` with a port for every key, giving new keys the
 // lowest port not already taken. Existing assignments are never changed.
 function assignPorts(map, keys) {
@@ -48,4 +45,4 @@ function assignPorts(map, keys) {
   return { map: out, changed }
 }
 
-module.exports = { loadPortMap, savePortMap, assignPorts }
+module.exports = { loadPortMap, savePortMap: writeJson, assignPorts, FIRST_PORT, LAST_PORT }

package/kernel/anywhere/serve.js

@@ -14,6 +14,8 @@
 */
 
 const DEFAULT_HTTPS_PORT = 443
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '0.0.0.0', '[::1]'])
+const { isDeepStrictEqual } = require('util')
 
 function normalizePort(value) {
   const port = Number(value)
@@ -27,7 +29,7 @@ function normalizePort(value) {
   options:
     dnsName    "pinokio.tail1234.ts.net" (no trailing dot)
     serverPort pinokiod's own port (mapped to :443)
-    targets    [{ listen, target }]: remote port -> local port
+    targets    [{ listen, target, origin? }]: remote port -> local port/origin
 */
 function buildServeConfig({ dnsName, serverPort, targets = [] } = {}) {
   const host = String(dnsName || '').replace(/\.$/, '')
@@ -35,11 +37,11 @@ function buildServeConfig({ dnsName, serverPort, targets = [] } = {}) {
     throw new Error('buildServeConfig requires dnsName')
   }
   const config = { TCP: {}, Web: {} }
-  const add = (listenPort, targetPort) => {
+  const add = (listenPort, targetPort, origin) => {
     config.TCP[String(listenPort)] = { HTTPS: true }
     config.Web[`${host}:${listenPort}`] = {
       Handlers: {
-        '/': { Proxy: `http://127.0.0.1:${targetPort}` }
+        '/': { Proxy: origin || `http://127.0.0.1:${targetPort}` }
       }
     }
   }
@@ -54,11 +56,11 @@ function buildServeConfig({ dnsName, serverPort, targets = [] } = {}) {
     const target = normalizePort(raw && raw.target)
     if (!listen || !target || seen.has(listen)) continue
     seen.add(listen)
-    entries.push({ listen, target })
+    entries.push({ listen, target, origin: raw.origin })
   }
   // deterministic key order so unchanged mappings compare equal
   for (const entry of entries.sort((a, b) => a.listen - b.listen)) {
-    add(entry.listen, entry.target)
+    add(entry.listen, entry.target, entry.origin)
   }
   return config
 }
@@ -89,7 +91,15 @@ function describeServeConfig(config, dnsName, names = {}) {
 }
 
 function sameServeConfig(a, b) {
-  return JSON.stringify(a || null) === JSON.stringify(b || null)
+  return isDeepStrictEqual(a || null, b || null)
 }
 
-module.exports = { buildServeConfig, describeServeConfig, sameServeConfig, DEFAULT_HTTPS_PORT }
+function rewriteHref(href, routes) {
+  let url
+  try { url = new URL(String(href)) } catch (_) { return href }
+  if (!/^https?:$/.test(url.protocol) || !LOOPBACK_HOSTS.has(url.hostname) || !url.port) return href
+  const route = routes.find((entry) => entry.local === Number(url.port))
+  return route ? route.url + url.pathname + url.search + url.hash : href
+}
+
+module.exports = { buildServeConfig, describeServeConfig, sameServeConfig, rewriteHref, LOOPBACK_HOSTS, DEFAULT_HTTPS_PORT }

package/kernel/anywhere/state.js

@@ -0,0 +1,14 @@
+const fs = require('fs')
+const path = require('path')
+const { randomUUID } = require('crypto')
+
+module.exports = async function writeJson(file, value) {
+  await fs.promises.mkdir(path.dirname(file), { recursive: true })
+  const temporary = `${file}.${randomUUID()}.tmp`
+  try {
+    await fs.promises.writeFile(temporary, JSON.stringify(value, null, 2), { flag: 'wx' })
+    await fs.promises.rename(temporary, file)
+  } finally {
+    await fs.promises.rm(temporary, { force: true }).catch(() => {})
+  }
+}

package/kernel/bin/conda-meta.js

@@ -3,7 +3,7 @@ const path = require('path')
 const { execFile } = require('child_process')
 const { managedPythonEnv } = require('../python_env')
 const semver = require('semver')
-const { PIP_MIN_VERSION } = require('./conda-pins')
+const { PIP_MIN_VERSION, PIP_SEED_SCRIPT } = require('./conda-pins')
 
 async function buildCondaListFromMeta(minicondaPath, useCondaList) {
   if (!useCondaList) {
@@ -122,8 +122,26 @@ async function hasSecureManagedPip(prefix, platform = process.platform) {
   })
 }
 
+async function runPipSeedRepair(prefix, wheel, platform = process.platform, check = false) {
+  const python = path.join(prefix, platform === 'win32' ? 'python.exe' : 'bin/python')
+  return await new Promise((resolve, reject) => {
+    execFile(python, ['-I', '-B', PIP_SEED_SCRIPT, wheel, prefix, ...(check ? ['--check'] : [])], {
+      env: managedPythonEnv(), windowsHide: true, timeout: 15000,
+    }, (error, stdout, stderr) => {
+      if (error) reject(new Error(`Managed Python pip seed ${check ? 'check' : 'repair'} failed: ${stderr || error.message}`))
+      else resolve(stdout)
+    })
+  })
+}
+
+async function hasSecureManagedPipSeed(prefix, wheel, platform = process.platform) {
+  return await runPipSeedRepair(prefix, wheel, platform, true).then(() => true, () => false)
+}
+
 module.exports = {
   buildCondaListFromMeta,
   managedCondaRuns,
   hasSecureManagedPip,
+  hasSecureManagedPipSeed,
+  runPipSeedRepair,
 }

package/kernel/bin/conda-pins.js

@@ -1,4 +1,7 @@
 const semver = require('semver')
+const path = require('path')
+const { resolveAsarPath } = require('../util')
+const PIP_WHEEL = require('../../system/pip_seed.json')
 
 const CONDA_PIN_VERSION = "26.5.3"
 // Conda 26.9.4 has no Python 3.10 builds. Apply its CA-bundle requirements
@@ -9,8 +12,8 @@ const TLS_PACKAGE_MINIMUMS = {
 }
 // conda-forge's patched pip requires Python 3.11; this official wheel supports 3.10.
 // Bootstrap URL and hash: https://discuss.python.org/t/109576
-const PIP_MIN_VERSION = '26.2.2'
-const PIP_INSTALL_COMMAND = 'python -I -m pip --isolated install --no-index "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"'
+const PIP_MIN_VERSION = PIP_WHEEL.version
+const PIP_SEED_SCRIPT = resolveAsarPath(path.resolve(__dirname, '../../system/repair_pip_seed.py'))
 const TLS_PACKAGE_SPECS = Object.entries(TLS_PACKAGE_MINIMUMS).map(([name, version]) => `${name}>=${version}`)
 const hasSecureTlsPackages = (versions = {}) => Object.entries(TLS_PACKAGE_MINIMUMS).every(([name, minimum]) => {
   const version = semver.coerce(versions[name])
@@ -46,7 +49,8 @@ const isExpectedPythonPinned = (platform, version, build) => {
 module.exports = {
   CONDA_PIN_VERSION,
   PIP_MIN_VERSION,
-  PIP_INSTALL_COMMAND,
+  PIP_WHEEL,
+  PIP_SEED_SCRIPT,
   TLS_PACKAGE_SPECS,
   hasSecureTlsPackages,
   PYTHON_INSTALL_SPEC,

package/kernel/bin/conda.js

@@ -1,12 +1,12 @@
 const fs = require('fs')
 const { glob } = require('glob')
 const semver = require('semver')
-const { createHash } = require('crypto')
+const { createHash, randomUUID } = require('crypto')
 const { isPathRemovalBlockedError, removePath } = require('../path_removal')
-const { buildCondaListFromMeta, managedCondaRuns, hasSecureManagedPip } = require('./conda-meta')
+const { buildCondaListFromMeta, managedCondaRuns, hasSecureManagedPip, hasSecureManagedPipSeed, runPipSeedRepair } = require('./conda-meta')
 const {
   CONDA_PIN_VERSION,
-  PIP_INSTALL_COMMAND,
+  PIP_WHEEL,
   TLS_PACKAGE_SPECS,
   hasSecureTlsPackages,
   PYTHON_INSTALL_SPEC,
@@ -76,6 +76,34 @@ class Conda {
       throw new Error('Miniforge installer SHA-256 verification failed. The installer was not run and existing environments were preserved.')
     }
   }
+  async cachePipWheel(ondata) {
+    const destination = this.kernel.bin.path(PIP_WHEEL.filename)
+    const verified = async file => {
+      const hash = createHash('sha256')
+      try {
+        for await (const chunk of fs.createReadStream(file)) hash.update(chunk)
+        return hash.digest('hex') === PIP_WHEEL.sha256
+      } catch (error) {
+        if (error.code === 'ENOENT') return false
+        throw error
+      }
+    }
+    if (await verified(destination)) return destination
+    const temporary = `.pip-seed-${randomUUID()}.whl`
+    const temporaryPath = this.kernel.bin.path(temporary)
+    try {
+      await this.kernel.bin.download(PIP_WHEEL.url, temporary, ondata)
+      if (!(await verified(temporaryPath))) throw new Error('Pip wheel SHA-256 verification failed; the runtime was not changed.')
+      await fs.promises.rename(temporaryPath, destination)
+    } finally {
+      await fs.promises.rm(temporaryPath, { force: true })
+    }
+    return destination
+  }
+  async preparePipSeed(ondata) {
+    const wheel = await this.cachePipWheel(ondata)
+    await runPipSeedRepair(this.kernel.bin.path(CONDA_ROOT_DIR), wheel, this.kernel.platform)
+  }
   env() {
     let base = {
       CONDA_PREFIX: this.kernel.bin.path(CONDA_ROOT_DIR),
@@ -121,7 +149,7 @@ report_errors: false`)
       }
     }
   }
-  async check() {
+  async check({ pipSeed = true } = {}) {
     let res = await buildCondaListFromMeta(this.kernel.bin.path(CONDA_ROOT_DIR))
 
     let lines = res.response.split(/[\r\n]+/)
@@ -169,7 +197,9 @@ report_errors: false`)
     if (!(conda_check.conda && conda_check.mamba && conda_check.python && hasSecureTlsPackages(conda_versions))) {
       return false
     }
-    return await hasSecureManagedPip(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.platform) && await managedCondaRuns(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.platform)
+    return await hasSecureManagedPip(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.platform) &&
+      (!pipSeed || await hasSecureManagedPipSeed(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.bin.path(PIP_WHEEL.filename), this.kernel.platform)) &&
+      await managedCondaRuns(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.platform)
   }
   async install(req, ondata) {
     await this.check()
@@ -177,21 +207,41 @@ report_errors: false`)
     if (isExpectedCondaPinned(versions.conda) &&
         isExpectedPythonPinned(this.kernel.platform, versions.python, builds.python) &&
         await managedCondaRuns(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.platform)) {
-      // Refresh a working runtime in place, preserving named app environments.
       await this.init()
-      const result = await this.kernel.bin.exec({
-        message: [
-          `conda install -y --override-channels -c conda-forge "${this.kernel.platform === "win32" ? WINDOWS_PYTHON_SSL_FIX_SPEC : PYTHON_INSTALL_SPEC}" "conda-libmamba-solver>=25.4.0" ${TLS_PACKAGE_SPECS.map(spec => `"${spec}"`).join(" ")}`,
-          PIP_INSTALL_COMMAND,
-        ],
-      }, ondata)
-      if (result?.error?.length || !(await this.check())) throw new Error("Conda certificate update failed; existing environments were preserved.")
+      const solverReady = semver.satisfies(semver.coerce(versions['conda-libmamba-solver']) || '0.0.0', '>=25.4.0')
+      if (solverReady && hasSecureTlsPackages(versions) && await hasSecureManagedPip(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.platform)) {
+        // Seed/cache damage is repaired without reinstalling Python or Conda.
+        await this.preparePipSeed(ondata)
+        if (!(await this.check())) throw new Error('Managed Python pip seed repair failed; existing environments were preserved.')
+        return
+      }
+      // Refresh a working runtime in place, preserving named app environments.
+      await this.cachePipWheel(ondata)
+      if (!solverReady || !hasSecureTlsPackages(versions)) {
+        const result = await this.kernel.bin.exec({
+          message: [
+            `conda install -y${solverReady ? '' : ' --solver classic'} --override-channels -c conda-forge "${this.kernel.platform === "win32" ? WINDOWS_PYTHON_SSL_FIX_SPEC : PYTHON_INSTALL_SPEC}" "conda-libmamba-solver>=25.4.0" ${TLS_PACKAGE_SPECS.map(spec => `"${spec}"`).join(" ")}`,
+          ],
+        }, ondata)
+        if (result?.error?.length) throw new Error("Conda certificate update failed; existing environments were preserved.")
+      }
+      if (!(await hasSecureManagedPip(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.platform))) {
+        const pip = await this.kernel.bin.exec({
+          message: { _: ['python', '-I', '-m', 'pip', '--isolated', 'install', '--no-index', PIP_WHEEL.filename] },
+        }, ondata)
+        if (pip?.error?.length) throw new Error("Conda certificate update failed; existing environments were preserved.")
+      }
+      await this.preparePipSeed(ondata)
+      if (!(await this.check())) throw new Error("Conda certificate update failed; existing environments were preserved.")
       return
     }
     for(let i=0; i<5; i++) {
       await this._install(req, ondata)
-      let installed = await this.check()
+      let installed = await this.check({ pipSeed: false })
       if (installed) {
+        if (!(await hasSecureManagedPipSeed(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.bin.path(PIP_WHEEL.filename), this.kernel.platform))) {
+          throw new Error('Managed Python pip seed verification failed; the runtime was preserved.')
+        }
         console.log("Conda properly installed and updated")
         return
       } else {
@@ -200,6 +250,7 @@ report_errors: false`)
     }
   }
   async _install(req, ondata) {
+    await this.cachePipWheel(ondata)
     const installer_url = this.urls[this.kernel.platform][this.kernel.arch]
     const installer = this.installer[this.kernel.platform]
     const install_path = this.kernel.bin.path(CONDA_ROOT_DIR)
@@ -278,7 +329,7 @@ report_errors: false`)
     let cmds = [
       "conda clean -y --all",
       `conda install -y --override-channels -c conda-forge ${condaPackages.join(" ")} ${mods}`.trim(),
-      PIP_INSTALL_COMMAND,
+      { _: ['python', '-I', '-m', 'pip', '--isolated', 'install', '--no-index', PIP_WHEEL.filename] },
     ]
     await this.kernel.bin.exec({
       message: cmds,
@@ -288,6 +339,7 @@ report_errors: false`)
     }, (stream) => {
       ondata(stream)
     })
+    await this.preparePipSeed(ondata)
     if (this.kernel.platform === "win32") {
       // copy python.exe to python3.exe so you can run with both python3 and python
       await fs.promises.copyFile(

package/kernel/bin/index.js

@@ -21,11 +21,12 @@ const LLVM = require('./llvm')
 const VS = require("./vs")
 const Cuda = require("./cuda")
 const Torch = require("./torch")
-const { buildCondaListFromMeta, managedCondaRuns, hasSecureManagedPip } = require('./conda-meta')
+const { buildCondaListFromMeta, managedCondaRuns, hasSecureManagedPip, hasSecureManagedPipSeed } = require('./conda-meta')
 const {
   isExpectedCondaPinned,
   isExpectedPythonPinned,
   hasSecureTlsPackages,
+  PIP_WHEEL,
 } = require('./conda-pins')
 const { glob } = require('glob')
 const fakeUa = require('fake-useragent');
@@ -414,7 +415,9 @@ class Bin {
       }
 
       if (conda_check.conda && conda_check.mamba && conda_check.python && hasSecureTlsPackages(conda_versions)) {
-        this.correct_conda = await hasSecureManagedPip(this.kernel.bin.path("miniforge"), this.platform) && await managedCondaRuns(this.kernel.bin.path("miniforge"), this.platform)
+        this.correct_conda = await hasSecureManagedPip(this.kernel.bin.path("miniforge"), this.platform) &&
+          await hasSecureManagedPipSeed(this.kernel.bin.path("miniforge"), this.kernel.bin.path(PIP_WHEEL.filename), this.platform) &&
+          await managedCondaRuns(this.kernel.bin.path("miniforge"), this.platform)
       }
     }
     this.installed.conda = conda

package/kernel/bin/setup.js

@@ -271,31 +271,17 @@ module.exports = {
     }
   },
   anywhere: (kernel) => {
-    let requirements = [
+    const requirements = [
       { name: "conda", },
-      { name: "zip", },
-    ]
-    if (platform === "darwin") {
-      requirements.push({ name: "brew" })
-    }
-    requirements = requirements.concat([
-      { name: "git", },
-      { name: "uv", },
-      { name: "node", },
       { name: "tailscaled", },
-      { name: "py" },
-      { name: "bluefairy" },
-    ])
+    ]
     return {
       icon: "fa-solid fa-mobile-screen",
       title: "Pinokio Anywhere",
       description: "Reach this Pinokio and its apps from your phone or another computer over a private Tailscale network",
       requirements,
       conda_requirements: [
-        zip_cmd,
-        "uv",
-        "git",
-        "tailscaled"
+        "tailscaled", "tailscale"
       ]
     }
   },

package/kernel/bin/tailscaled.js

@@ -1,15 +1,15 @@
 const path = require('path')
-const semver = require('semver')
+const fs = require('fs')
+const { execFile } = require('child_process')
+const { promisify } = require('util')
+const run = promisify(execFile)
 
-// conda-forge ships only the daemon binary (no `tailscale` CLI); Pinokio
-// drives it over its LocalAPI (see kernel/anywhere).
-const TAILSCALED_SPEC = "tailscaled=1.104.1"
-const TAILSCALED_REQUIREMENT = ">=1.104.0"   // 1.104 added --windows-mode=dev
+const VERSION = '1.104.1'
 
 class Tailscaled {
   description = "Installs the Tailscale daemon for Pinokio Anywhere: reach this Pinokio and its apps from your phone or another computer over a private network."
   cmd() {
-    return TAILSCALED_SPEC
+    return `tailscaled=${VERSION} tailscale=${VERSION}`
   }
   binPath() {
     if (this.kernel.platform === "win32") {
@@ -17,6 +17,9 @@ class Tailscaled {
     }
     return this.kernel.bin.path("miniforge", "bin", "tailscaled")
   }
+  cliPath() {
+    return path.join(path.dirname(this.binPath()), this.kernel.platform === 'win32' ? 'tailscale.exe' : 'tailscale')
+  }
   async install(req, ondata) {
     await this.kernel.bin.exec({
       message: [
@@ -30,15 +33,22 @@ class Tailscaled {
   async installed() {
     try {
       const conda = this.kernel.bin.installed && this.kernel.bin.installed.conda
-      if (!conda || !conda.has("tailscaled")) {
+      if (!conda || !['tailscaled', 'tailscale'].every((name) => conda.has(name))) {
         return false
       }
       const versions = this.kernel.bin.installed.conda_versions || {}
-      const coerced = semver.coerce(versions.tailscaled)
-      if (!coerced) {
-        return false
+      for (const [name, bin] of [['tailscaled', this.binPath()], ['tailscale', this.cliPath()]]) {
+        if (versions[name] !== VERSION) return false
+        const stat = await fs.promises.stat(bin)
+        const key = `${bin}:${stat.mtimeMs}:${stat.size}`
+        if (!this.verified) this.verified = new Set()
+        if (!this.verified.has(key)) {
+          const { stdout } = await run(bin, ['--version'], { shell: false, windowsHide: true, timeout: 5000 })
+          if (stdout.trim().split(/\s/)[0] !== VERSION) return false
+          this.verified.add(key)
+        }
       }
-      return semver.satisfies(coerced, TAILSCALED_REQUIREMENT)
+      return true
     } catch (e) {
       console.log("tailscaled installed check error", e)
       return false
@@ -59,11 +69,11 @@ class Tailscaled {
   async uninstall(req, ondata) {
     ondata({ raw: "stopping Pinokio Anywhere\r\n" })
     if (this.kernel.anywhere && typeof this.kernel.anywhere.stop === "function") {
-      await this.kernel.anywhere.stop().catch(() => {})
+      await this.kernel.anywhere.stop()
     }
     ondata({ raw: "cleaning up\r\n" })
     await this.kernel.bin.exec({
-      message: `conda remove -y tailscaled`,
+      message: `conda remove -y tailscaled tailscale`,
     }, ondata)
     ondata({ raw: "finished cleaning up\r\n" })
   }

package/kernel/index.js

@@ -714,12 +714,10 @@ class Kernel {
     }
     // 8b. Pinokio Anywhere: refresh the tailscale serve config from the apps'
     // published URLs. No-op unless Anywhere is on and its daemon is running.
-    if (this.anywhere) {
-      try {
-        await this.anywhere.sync()
-      } catch (err) {
+    if (this.anywhere && !this.anywhere.syncing) {
+      this.anywhere.sync().catch((err) => {
         console.warn('[anywhere] sync failed:', err && err.message ? err.message : err)
-      }
+      })
     }
     // 6. tell peers to refresh
     let changed
@@ -1095,6 +1093,14 @@ class Kernel {
 ///    })
 ///  }
   async init(options) {
+    if (this.anywhere && this.homedir) {
+      // Stop against the old home before changing paths or startup readiness.
+      try { await this.anywhere.stop() }
+      catch (error) {
+        if (error.code !== 'ERR_ANYWHERE_UNOWNED') throw error
+        console.warn('[anywhere]', error.message)
+      }
+    }
     // Re-arm startup readiness on every init cycle so restart waits for the
     // newly rebuilt template/sysinfo state instead of a stale resolved promise.
     this.sysReady = new Promise((resolve) => {
@@ -1113,10 +1119,6 @@ class Kernel {
     if (this.peer) {
       this.peer.stop()
     }
-    if (this.anywhere) {
-      // re-initializing the kernel (home change): drop the old daemon
-      await this.anywhere.stop().catch(() => {})
-    }
 
     this.info = new Info(this)
     this.pipe = new Pipe(this)

package/kernel/shell.js

@@ -21,7 +21,7 @@ const ShellParser = require('./shell_parser')
 const AnsiStreamTracker = require('./ansi_stream_tracker')
 const ShellStateSync = require('./shell_state_sync')
 const ShellRunTemplate = require('./api/shell_run_template')
-const { PYTHON_INSTALL_SPEC, PIP_INSTALL_COMMAND } = require('./bin/conda-pins')
+const { PYTHON_INSTALL_SPEC, PIP_WHEEL, PIP_SEED_SCRIPT } = require('./bin/conda-pins')
 const CondaRuntimeGuard = require('./shell_conda_runtime_guard')
 const home = os.homedir()
 const WINDOWS_CMD_CONDA_COMMAND_PATTERN = /(?:^|[&|()]\s*)@?\s*(?:call\s+)?(?:"[^"]*[\\/]conda(?:\.bat|\.exe)?"|(?:[a-z]:)?[^&|()\s"]*[\\/]conda(?:\.bat|\.exe)?|conda(?:\.bat|\.exe)?)\s+/i
@@ -1280,8 +1280,8 @@ class Shell {
           // calling vcvars, but vcvars rebuilds LIB and drops that entry.
           // Restore both the active Conda environment and managed CUDA import
           // libraries after all compiler activation scripts have completed.
-          // Escape the quotes and variable names for interactive cmd.exe so
-          // CALL expands the current values only after activation has finished.
+          // CALL's second expansion is required because these commands are
+          // joined on one cmd.exe line and must read LIB after vcvars updates it.
           conda_activation.push(`CALL set ^"LIB=%^CONDA_PREFIX%\\Library\\lib;%^CUDA_HOME%\\lib;%^LIB%^"`)
         } catch (e) {
           console.log('vc vars setup', e)
@@ -1396,12 +1396,20 @@ class Shell {
               `python -m venv ${shellEnvPath}`,
               activate_command,
 //              `python -m pip install --upgrade pip setuptools wheel`,
-              deactivate_path,
 //              timeout,
-              activate_command,
 //              timeout,
-              this.isPowerShell() ? `${PIP_INSTALL_COMMAND}; if ($LASTEXITCODE -ne 0) { exit 1 }` : this.isCmdShell() ? `(${PIP_INSTALL_COMMAND} || exit 1)` : `${PIP_INSTALL_COMMAND} || exit 1`,
             ]
+            // Base is prepared during setup; custom Conda Python needs its own seed.
+            if (!conda_activate && (conda_path || (conda_name && conda_name !== 'base'))) {
+              const prefix = conda_path ? path.resolve(params.path, conda_path) : this.kernel.bin.path('miniforge/envs', conda_name)
+              if (normalizeComparablePath(prefix, this.platform) !== normalizeComparablePath(this.kernel.bin.path('miniforge'), this.platform)) {
+                const args = [PIP_SEED_SCRIPT, this.kernel.bin.path(PIP_WHEEL.filename), prefix]
+                const command = this.isCmdShell() ? `python -I -B ${args.map(value => `"${value}"`).join(' ')}` : this.build({ message: { _: ['python', '-I', '-B', ...args] } })
+                venv_activation.unshift(this.isPowerShell()
+                  ? `${command}; if (!$?) { exit 1 }`
+                  : this.isCmdShell() ? `(${command} || exit 1)` : `${command} || exit $?`)
+              }
+            }
           }
         }
       } else {

package/kernel/util.js

@@ -1247,6 +1247,7 @@ const rewrite_localhost= (kernel, obj, source) => {
 
 module.exports = {
   NestedLayout: require('./nested_layout'),
+  resolveAsarPath,
   parse_env,
   log_path,
   api_path,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.2.10",
+  "version": "8.2.12",
   "description": "",
   "main": "index.js",
   "scripts": {