pinokiod 8.2.10 → 8.2.12

package/test/shell-run-template.test.js

@@ -7,7 +7,7 @@ const { spawnSync } = require('node:child_process')
 
 const ShellRunTemplate = require('../kernel/api/shell_run_template')
 const Shell = require('../kernel/shell')
-const { PIP_INSTALL_COMMAND } = require('../kernel/bin/conda-pins')
+const { PIP_SEED_SCRIPT, PIP_WHEEL } = require('../kernel/bin/conda-pins')
 
 function createKernel(root = process.cwd()) {
   return {
@@ -399,11 +399,11 @@ test('redactEnvArgs summarizes protected argv env values', () => {
 })
 
 
-test('only new default venvs bootstrap pip across supported shells', async t => {
+test('venv selection preserves legacy activation without a per-venv pip install', async t => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-venv-selection-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
   const cases = [
-    { venv: "default env $NAME O'Brien (test)" },
+    { venv: 'default-env' },
     { venv: { path: 'object-default-env' } },
     { venv: 'explicit-env', venv_python: '3.10', version: '3.10' },
     { venv: { path: 'object-env', python: '3.11' }, version: '3.11' },
@@ -413,26 +413,20 @@ test('only new default venvs bootstrap pip across supported shells', async t =>
   ]
   await fs.mkdir(path.join(root, 'existing-env'))
   for (const [platform, shellName] of [
-    ['linux', 'bash'],
-    ['darwin', 'bash'],
-    ['win32', 'cmd.exe'],
-    ['win32', 'powershell'],
-    ['win32', 'bash'],
+    ['linux', 'bash'], ['darwin', 'bash'], ['win32', 'cmd.exe'],
+    ['win32', 'powershell'], ['win32', 'bash'],
   ]) {
     for (const scenario of cases) {
       const shell = createShell(createKernel(root))
       shell.platform = platform
       shell.shell = shellName
       const params = await shell.activate({
-        path: root,
-        conda: { skip: true },
-        venv: scenario.venv,
-        venv_python: scenario.venv_python,
-        message: 'echo PINOKIO_REQUIREMENTS_RAN',
+        path: root, conda: { skip: true }, venv: scenario.venv,
+        venv_python: scenario.venv_python, message: 'echo PINOKIO_REQUIREMENTS_RAN',
       })
       const command = shell.build(params)
-      assert.doesNotMatch(command, /--seed|--no-config|--python-preference|uv pip install/)
-      assert.match(command, /echo PINOKIO_REQUIREMENTS_RAN$/)
+      assert.match(command, /echo PINOKIO_REQUIREMENTS_RAN/)
+      assert.doesNotMatch(command, /--seed|--no-config|--python-preference|uv pip install|-m pip|https:|sha256|repair_pip_seed|\bCALL\s|\bexit\s/)
       if (!scenario.venv || scenario.existing) {
         assert.doesNotMatch(command, /python -m venv|uv venv/)
       } else if (scenario.version) {
@@ -441,28 +435,17 @@ test('only new default venvs bootstrap pip across supported shells', async t =>
       } else {
         assert.match(command, /python -m venv /)
       }
-      if (scenario.venv && !scenario.version && !scenario.existing) {
-        assert.equal(command.split(PIP_INSTALL_COMMAND).length - 1, 1)
-        assert.ok(command.indexOf(PIP_INSTALL_COMMAND) > command.lastIndexOf('activate'))
-        const envPath = path.resolve(root, typeof scenario.venv === 'string' ? scenario.venv : scenario.venv.path)
-        const shellPath = shell.isCmdShell() ? `"${envPath}"` : shell.quoteArgForShell(platform === 'win32' && /bash/i.test(shellName) ? require('../kernel/util').p2u(envPath) : envPath)
-        for (const step of [`python -m venv ${shellPath}`, PIP_INSTALL_COMMAND]) {
-          assert.ok(command.includes(shell.isPowerShell()
-            ? `${step}; if ($LASTEXITCODE -ne 0) { exit 1 }`
-            : `${step} || exit 1`))
-        }
-      } else {
-        assert.doesNotMatch(command, /-m pip/)
-      }
       if (scenario.venv) {
         const envPath = path.resolve(root, typeof scenario.venv === 'string' ? scenario.venv : scenario.venv.path)
-        const script = path.resolve(envPath, platform === 'win32' ? 'Scripts' : 'bin', shell.isPowerShell() ? 'Activate.ps1' : 'activate')
-        const scriptPath = shell.isCmdShell() ? `"${script}"` : shell.quoteArgForShell(platform === 'win32' && /bash/i.test(shellName) ? require('../kernel/util').p2u(script) : script)
-        assert.ok(command.includes(shell.isPowerShell()
-          ? `& ${scriptPath}`
-          : shell.isCmdShell() ? scriptPath : `source ${scriptPath}`), command)
-        assert.ok(command.includes(shell.isPowerShell() ? '; if (!$?) { exit 1 }' : ' || exit 1'), command)
-        if (shell.isPowerShell()) assert.doesNotMatch(command, /Scripts[\\/]deactivate/)
+        const script = path.resolve(envPath, platform === 'win32' ? 'Scripts' : 'bin', 'activate')
+        const windowsBash = platform === 'win32' && /bash/i.test(shellName)
+        const scriptPath = windowsBash ? `"${require('../kernel/util').p2u(script)}"` : script
+        const target = windowsBash ? `"${require('../kernel/util').p2u(envPath)}"` : envPath
+        const activation = `${platform !== 'win32' || windowsBash ? 'source ' : ''}${scriptPath} ${target}`
+        assert.ok(command.includes(activation), command)
+        assert.equal(command.split(scriptPath).length - 1, scenario.version && !scenario.existing ? 2 : 1, command)
+        if (!scenario.version) assert.doesNotMatch(command, /\bdeactivate\b/i)
+        assert.equal(params.message[1], 'echo PINOKIO_REQUIREMENTS_RAN')
       }
       assert.equal(shell.env.UV_PYTHON_PREFERENCE, 'only-managed')
     }
@@ -470,128 +453,152 @@ test('only new default venvs bootstrap pip across supported shells', async t =>
 })
 
 
-test('failed venv creation or pip bootstrap stops an unconditional command chain', async t => {
-  if (process.platform === 'win32') return t.skip('executes the POSIX shell failure guard')
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-pip-failure-'))
-  t.after(() => fs.rm(root, { recursive: true, force: true }))
-  const binDir = path.join(root, 'bin')
-  await fs.mkdir(binDir)
-  await fs.writeFile(path.join(binDir, 'python'), `#!/bin/sh
-if [ "$1" = "-m" ] && [ "$2" = "venv" ]; then
-  [ "$PINOKIO_TEST_VENV_EXIT_CODE" = "0" ] || exit "$PINOKIO_TEST_VENV_EXIT_CODE"
-  mkdir -p "$3/bin"
-  echo 'deactivate() { :; }' > "$3/bin/activate"
-else
-  echo PINOKIO_PIP_BOOTSTRAP_RAN
-  exit "$PINOKIO_TEST_PIP_EXIT_CODE"
-fi
-`, { mode: 0o755 })
-  const shell = createShell(createKernel(root))
-  shell.shell = 'bash'
-  const params = await shell.activate({
-    path: root, conda: { skip: true }, venv: 'env',
-    chain: '*', message: 'echo PINOKIO_APPLICATION_RAN',
-  })
-  const command = shell.build(params)
-  for (const [venvExit, pipExit] of [[9, 0], [0, 7], [0, 0]]) {
-    const result = spawnSync('/bin/bash', ['-c', command], {
-      encoding: 'utf8',
-      env: { ...process.env, PATH: `${binDir}${path.delimiter}${process.env.PATH}`, PINOKIO_TEST_VENV_EXIT_CODE: String(venvExit), PINOKIO_TEST_PIP_EXIT_CODE: String(pipExit) },
-    })
-    assert.equal(result.status, venvExit || pipExit ? 1 : 0, result.stderr)
-    assert.equal(result.stdout.includes('PINOKIO_APPLICATION_RAN'), venvExit === 0 && pipExit === 0)
-    assert.equal(result.stdout.includes('PINOKIO_PIP_BOOTSTRAP_RAN'), venvExit === 0)
-  }
-})
 
 
-test('venv paths remain literal through creation and repeated activation', async t => {
-  if (process.platform === 'win32') return t.skip('executes bash commands')
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-venv-paths-'))
+
+
+
+test('only new stdlib venvs under custom Conda prefixes run the local seed repair', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-custom-seed-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
-  const bin = path.join(root, 'bin')
-  const project = path.join(root, "project & $NAME O'Brien (test)")
-  await fs.mkdir(bin)
-  await fs.mkdir(project)
-  const fixture = path.join(root, 'activate')
-  await fs.writeFile(fixture, 'export VIRTUAL_ENV="$PINOKIO_TEST_ENV"\ndeactivate() { unset VIRTUAL_ENV; }\n')
-  const executable = `#!/bin/sh
-if [ "$1" = "-m" ] && [ "$2" = "venv" ]; then
-  [ "$#" = "3" ] || exit 9
-  target=$3
-elif [ "$1" = "venv" ]; then
-  [ "$#" = "4" ] || exit 9
-  target=$2
-else
-  echo "PINOKIO_BOOTSTRAP_TARGET=$VIRTUAL_ENV"
-  exit 0
-fi
-printf '%s' "$target" > "$PINOKIO_TEST_CREATED"
-mkdir -p "$target/bin"
-cp "$PINOKIO_TEST_ACTIVATE" "$target/bin/activate"
-`
-  await fs.writeFile(path.join(bin, 'python'), executable, { mode: 0o755 })
-  await fs.writeFile(path.join(bin, 'uv'), executable, { mode: 0o755 })
-  for (const explicit of [false, true]) {
-    const venv = explicit ? 'uv env $NAME' : 'default env $NAME'
-    const envPath = path.join(project, venv)
-    const created = path.join(root, 'created')
-    for (const existing of [false, true]) {
-      const shell = createShell(createKernel(root))
-      shell.shell = 'bash'
-      const params = await shell.activate({
-        path: project, conda: { skip: true }, venv,
-        ...(explicit ? { venv_python: '3.10' } : {}),
-        chain: '*', message: 'printf "PINOKIO_APP_TARGET=%s\\n" "$VIRTUAL_ENV"',
-      })
-      const result = spawnSync('/bin/bash', ['-c', shell.build(params)], {
-        encoding: 'utf8', env: {
-          ...process.env, PATH: `${bin}${path.delimiter}${process.env.PATH}`,
-          VIRTUAL_ENV: '', NAME: 'must-not-expand',
-          PINOKIO_TEST_ENV: envPath, PINOKIO_TEST_CREATED: created, PINOKIO_TEST_ACTIVATE: fixture,
-        },
-      })
-      assert.equal(result.status, 0, result.stdout + result.stderr)
-      assert.equal(await fs.readFile(created, 'utf8'), envPath)
-      assert.ok(result.stdout.includes(`PINOKIO_APP_TARGET=${envPath}\n`), result.stdout)
-      assert.equal(result.stdout.includes(`PINOKIO_BOOTSTRAP_TARGET=${envPath}\n`), !explicit && !existing)
+  await fs.mkdir(path.join(root, 'existing-env'))
+  for (const [platform, shellName] of [['darwin', 'bash'], ['linux', 'bash'], ['win32', 'cmd.exe'], ['win32', 'powershell'], ['win32', 'bash']]) {
+    for (const [conda, expected] of [[undefined, false], [{ name: 'base' }, false],
+      ['bin/miniforge', false], [{ skip: true }, false], [{ name: 'custom' }, true],
+      [{ path: "custom O'Brien & (test)" }, true], ['custom', true],
+      [{ name: 'custom', activate: 'minimal' }, false], [{ name: 'custom', activate: ['custom activation'] }, false]]) {
+      for (const kind of ['new', 'existing', 'uv']) {
+        const kernel = createKernel(root)
+        kernel.bin = { path: (...parts) => path.join(root, 'bin', ...parts) }
+        const shell = createShell(kernel)
+        shell.platform = platform
+        shell.shell = shellName
+        const params = await shell.activate({ path: root, conda,
+          venv: kind === 'existing' ? 'existing-env' : 'env',
+          ...(kind === 'uv' ? { venv_python: '3.11' } : {}), message: 'echo PINOKIO_APPLICATION_RAN' })
+        const command = shell.build(params)
+        const repair = expected && kind === 'new'
+        assert.equal(command.includes('repair_pip_seed.py'), repair, command)
+        assert.doesNotMatch(command, /https:|sha256|-m pip/)
+        if (repair) {
+          assert.ok(command.indexOf('repair_pip_seed.py') < command.indexOf('python -m venv'), command)
+          assert.ok(command.includes(PIP_WHEEL.filename), command)
+          if (shell.isCmdShell()) assert.doesNotMatch(command.slice(command.indexOf('python -I -B')), /\^/)
+          assert.equal((command.match(/\bexit 1\b/g) || []).length, shell.isCmdShell() || shell.isPowerShell() ? 1 : 0, command)
+        }
+      }
     }
   }
 })
 
-test('failed activation stops before pip or application commands', async t => {
-  if (process.platform === 'win32') return t.skip('executes bash commands')
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-venv-activation-'))
+test('custom Conda repair failure is retried after the Conda prefix already exists', async t => {
+  if (process.platform === 'win32') return t.skip('executes bash command chains')
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-custom-seed-retry-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
   const bin = path.join(root, 'bin')
   await fs.mkdir(bin)
+  const trace = path.join(root, 'trace')
+  const prefix = path.join(root, "custom O'Brien & (test)")
   await fs.writeFile(path.join(bin, 'python'), `#!/bin/sh
-if [ "$1" = "-m" ] && [ "$2" = "venv" ]; then
+if [ "$1" = "-I" ]; then
+  [ "$#" = "5" ] && [ "$5" = "$PINOKIO_TEST_PREFIX" ] || exit 9
+  echo repair >> "$PINOKIO_TEST_TRACE"
+  exit "$PINOKIO_TEST_REPAIR_EXIT"
+elif [ "$1" = "-m" ] && [ "$2" = "venv" ]; then
+  echo create >> "$PINOKIO_TEST_TRACE"
   mkdir -p "$3/bin"
-  if [ "$PINOKIO_TEST_FAILURE" = "second" ]; then
-    echo 'deactivate() { rm -f "$PINOKIO_TEST_ENV/bin/activate"; }' > "$3/bin/activate"
-  fi
+  echo 'deactivate() { :; }' > "$3/bin/activate"
 else
-  echo PINOKIO_BOOTSTRAP_RAN
+  exit 9
 fi
 `, { mode: 0o755 })
-  for (const failure of ['first', 'second', 'existing']) {
-    const venv = `${failure} env`
-    if (failure === 'existing') await fs.mkdir(path.join(root, venv))
-    const shell = createShell(createKernel(root))
+  for (const failure of [true, false]) {
+    const kernel = createKernel(root)
+    kernel.bin = { path: (...parts) => path.join(bin, ...parts) }
+    const shell = createShell(kernel)
     shell.shell = 'bash'
-    const params = await shell.activate({
-      path: root, conda: { skip: true }, venv,
-      chain: '*', message: 'echo PINOKIO_APPLICATION_RAN',
+    shell.conda_hook = () => ''
+    const params = await shell.activate({ path: root, conda: { path: path.basename(prefix) }, venv: 'env',
+      chain: '*', message: 'echo PINOKIO_APPLICATION_RAN' })
+    assert.equal(shell.build(params).includes('conda create'), failure)
+    const result = spawnSync('/bin/bash', ['-c', `conda() { if [ "$1" = create ]; then mkdir -p "$4"; fi; }\n${shell.build(params)}`], {
+      encoding: 'utf8', env: { ...process.env, PATH: `${bin}${path.delimiter}${process.env.PATH}`,
+        PINOKIO_TEST_REPAIR_EXIT: failure ? '7' : '0', PINOKIO_TEST_TRACE: trace, PINOKIO_TEST_PREFIX: prefix },
     })
-    const result = spawnSync('/bin/bash', ['-c', shell.build(params)], {
-      encoding: 'utf8', env: {
-        ...process.env, PATH: `${bin}${path.delimiter}${process.env.PATH}`,
-        PINOKIO_TEST_FAILURE: failure, PINOKIO_TEST_ENV: path.join(root, venv),
-      },
+    assert.equal(result.status, failure ? 7 : 0, result.stdout + result.stderr)
+    assert.equal(result.stdout.includes('PINOKIO_APPLICATION_RAN'), !failure)
+    assert.equal(await fs.access(path.join(root, 'env')).then(() => true, () => false), !failure)
+  }
+  assert.equal(await fs.readFile(trace, 'utf8'), 'repair\nrepair\ncreate\n')
+})
+
+
+
+
+
+test('uv retains its existing creation and deactivation failure behavior', async t => {
+  if (process.platform === 'win32') return t.skip('executes bash commands')
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-setup-uv-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  await fs.mkdir(path.join(root, 'bin'))
+  await fs.writeFile(path.join(root, 'bin', 'uv'), `#!/bin/sh
+mkdir -p "$2/bin"
+echo 'deactivate() { return 7; }' > "$2/bin/activate"
+exit 7
+`, { mode: 0o755 })
+  const shell = createShell(createKernel(root))
+  shell.shell = 'bash'
+  const params = await shell.activate({ path: root, conda: { skip: true }, venv: 'env', venv_python: '3.11',
+    message: 'echo APP' })
+  const result = spawnSync('/bin/bash', ['-c', shell.build(params)], {
+    encoding: 'utf8', env: { ...process.env, PATH: `${path.join(root, 'bin')}${path.delimiter}${process.env.PATH}` },
+  })
+  assert.equal(result.status, 0, result.stderr)
+  assert.equal(result.stdout, 'APP\n')
+})
+
+test('failed custom seed repair stops venv creation and all app commands', async t => {
+  const powershell = process.env.PINOKIO_TEST_PWSH || (process.platform === 'win32' ? 'powershell.exe' : null)
+  for (const [name, executable] of [
+    ['bash', process.platform !== 'win32' ? '/bin/bash' : null],
+    ['CMD', process.platform === 'win32' ? 'cmd.exe' : null],
+    ['PowerShell', powershell],
+  ]) {
+    await t.test(name, { skip: !executable && `requires ${name}` }, async t => {
+      const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-seed-stop-'))
+      t.after(() => fs.rm(root, { recursive: true, force: true }))
+      const bin = path.join(root, 'bin')
+      const trace = path.join(root, 'trace')
+      await fs.mkdir(bin)
+      await fs.mkdir(path.join(root, 'custom'))
+      await fs.writeFile(path.join(bin, process.platform === 'win32' ? 'python.bat' : 'python'),
+        process.platform === 'win32'
+          ? '@echo %1>>"%PINOKIO_TEST_TRACE%"\r\n@exit /b 7\r\n'
+          : '#!/bin/sh\nprintf "%s\\n" "$1" >> "$PINOKIO_TEST_TRACE"\nexit 7\n', { mode: 0o755 })
+      if (name === 'CMD') await fs.writeFile(path.join(bin, 'conda.bat'), '@exit /b 0\r\n')
+      const chains = name === 'PowerShell' ? ['*'] : [undefined, '&', '|', '*']
+      for (const chain of chains) {
+        const kernel = createKernel(root)
+        kernel.bin = { path: (...parts) => path.join(bin, ...parts) }
+        const shell = createShell(kernel)
+        shell.shell = executable
+        shell.conda_hook = () => ''
+        const message = name === 'PowerShell' ? 'Write-Output FIRST; Write-Output SECOND'
+          : name === 'CMD' ? 'echo FIRST & echo SECOND' : 'echo FIRST; echo SECOND'
+        const params = await shell.activate({ path: root, conda: { path: 'custom' }, venv: 'env', chain, message })
+        const command = (name === 'bash' ? 'conda() { :; }\n' : name === 'PowerShell' ? 'function conda {}\n' : '') + shell.build(params)
+        const result = spawnSync(executable, name === 'CMD' ? ['/D', '/Q']
+          : name === 'PowerShell' ? ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', command] : ['-c', command], {
+          ...(name === 'CMD' ? { input: `${command}\r\nexit\r\n` } : {}),
+          cwd: root, encoding: 'utf8', timeout: 15000,
+          env: { ...process.env, PATH: `${bin}${path.delimiter}${process.env.PATH}`, PINOKIO_TEST_TRACE: trace },
+        })
+        assert.ifError(result.error)
+        assert.equal(result.status, name === 'bash' ? 7 : 1, result.stdout + result.stderr)
+        assert.doesNotMatch(result.stdout, /FIRST|SECOND/)
+        assert.equal(await fs.access(path.join(root, 'env')).then(() => true, () => false), false)
+      }
+      assert.deepEqual((await fs.readFile(trace, 'utf8')).trim().split(/\r?\n/), chains.map(() => '-I'))
     })
-    assert.equal(result.status, 1, `${failure}: ${result.stdout}${result.stderr}`)
-    assert.equal(result.stdout.includes('PINOKIO_BOOTSTRAP_RAN'), false, failure)
-    assert.equal(result.stdout.includes('PINOKIO_APPLICATION_RAN'), false, failure)
   }
 })

package/test/tailscale-cli.test.js

@@ -0,0 +1,239 @@
+const assert = require('node:assert/strict')
+const test = require('node:test')
+const http = require('node:http')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+const vm = require('node:vm')
+const { EventEmitter } = require('node:events')
+const TailscaleCLI = require('../kernel/anywhere/cli')
+const Anywhere = require('../kernel/anywhere')
+const Tailscaled = require('../kernel/bin/tailscaled')
+
+test('CLI login delivers each streamed update once and rejects output-handler failures', async () => {
+  const source = fs.readFileSync(require.resolve('../kernel/anywhere/cli'), 'utf8')
+  const cliRequire = require('node:module').createRequire(require.resolve('../kernel/anywhere/cli'))
+  for (const failure of [null, 'json', 'callback']) {
+    let finish, killed = false
+    const child = { stdout: new EventEmitter(), kill() { killed = true } }
+    const module = { exports: {} }
+    vm.runInNewContext(source, { module, require(name) {
+      if (name !== 'child_process') return cliRequire(name)
+      return { execFile(file, args, options, callback) { finish = callback; return child } }
+    } })
+    const cli = new module.exports({ binPath: 'fixture', socketPath: 'fixture' })
+    const seen = []
+    let updates = 0
+    const result = cli.up(value => {
+      updates++
+      if (failure === 'callback') throw new Error('handler failed')
+      seen.push(value.AuthURL)
+    })
+    const checked = failure ? assert.rejects(result, failure === 'json' ? { name: 'SyntaxError' } : /handler failed/) : result
+    const first = '{\n  "AuthURL": "first"\n}\n'
+    const second = '{\n  "AuthURL": "second"\n}\n'
+    assert.doesNotThrow(() => {
+      child.stdout.emit('data', failure === 'json' ? '{\nINVALID JSON\n}\n' : first)
+      if (!failure) {
+        child.stdout.emit('data', second.slice(0, 10))
+        child.stdout.emit('data', second.slice(10))
+      } else {
+        child.stdout.emit('data', second)
+      }
+    })
+    finish(null, '', '')
+    await checked
+    assert.equal(killed, !!failure)
+    assert.equal(cli.children.size, 0)
+    assert.equal(updates, failure === 'json' ? 0 : failure === 'callback' ? 1 : 2)
+    if (!failure) assert.deepEqual(seen, ['first', 'second'])
+  }
+})
+
+// Run against the actual pinned binary on each native platform. No system
+// Tailscale endpoint, account or network settings are used by these tests.
+const binPath = process.env.PINOKIO_TEST_TAILSCALE
+test('pinned CLI: login, approvals, conditional Serve writes, failures and cancellation', { skip: !binPath, timeout: 30000 }, async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-cli-'))
+  const socketPath = process.platform === 'win32' ? `\\\\.\\pipe\\pinokio-test-${process.pid}` : path.join(tmp, 'api.sock')
+  const seen = []
+  let config = null
+  let revision = 1
+  let conflict = false
+  let failure = 0
+  let bus = null
+  let loginNumber = 0
+  let status = {
+    BackendState: 'Running', Version: '1.104.1', TailscaleIPs: ['100.100.100.100'],
+    Self: { DNSName: 'pinokio.tail1.ts.net.', TailscaleIPs: ['100.100.100.100'] },
+    CertDomains: ['pinokio.tail1.ts.net'], CurrentTailnet: { MagicDNSSuffix: 'tail1.ts.net' },
+  }
+  const server = http.createServer((req, res) => {
+    let body = ''
+    req.on('data', (chunk) => { body += chunk })
+    req.on('end', () => {
+      seen.push({ method: req.method, url: req.url, body, etag: req.headers['if-match'] })
+      res.setHeader('Content-Type', 'application/json')
+      res.setHeader('Tailscale-Version', '1.104.1')
+      if (req.url.startsWith('/localapi/v0/status')) {
+        if (failure) { res.statusCode = failure; return res.end('control failure') }
+        return res.end(JSON.stringify(status))
+      }
+      if (req.url === '/localapi/v0/serve-config') {
+        if (req.method === 'POST') {
+          if (conflict || req.headers['if-match'] !== `v${revision}`) { res.statusCode = 412; return res.end('changed concurrently') }
+          config = JSON.parse(body); revision += 1
+          return res.end('{}')
+        }
+        res.setHeader('Etag', `v${revision}`)
+        return res.end(JSON.stringify(config))
+      }
+      if (req.url === '/localapi/v0/query-feature?feature=serve') return res.end(JSON.stringify({ Complete: !!status.CertDomains, URL: 'https://login.tailscale.com/f/serve?node=1', Text: 'Approve HTTPS' }))
+      if (req.url === '/localapi/v0/prefs' || req.url === '/localapi/v0/check-prefs') return res.end('{}')
+      if (req.url.startsWith('/localapi/v0/watch-ipn-bus')) { bus = res; res.flushHeaders(); return }
+      if (req.url === '/localapi/v0/start' || req.url === '/localapi/v0/login-interactive') {
+        if (bus && req.url.endsWith('/login-interactive')) bus.write(JSON.stringify({ BrowseToURL: `https://login.tailscale.com/a/fresh${++loginNumber}` }) + '\n')
+        res.statusCode = 204; return res.end()
+      }
+      if (req.url === '/localapi/v0/logout') { status.BackendState = 'NeedsLogin'; res.statusCode = 204; return res.end() }
+      res.statusCode = 404; res.end(`unexpected ${req.url}`)
+    })
+  })
+  const connections = new Set()
+  server.on('connection', (socket) => { connections.add(socket); socket.on('close', () => connections.delete(socket)) })
+  const cli = new TailscaleCLI({ binPath, socketPath })
+  try {
+    await new Promise((resolve, reject) => { server.once('error', reject); server.listen(socketPath, resolve) })
+    assert.equal((await cli.status()).Version, '1.104.1')
+    await cli.setPrefs('pinokio')
+    const prefs = JSON.parse(seen.find((r) => r.method === 'PATCH' && r.url.endsWith('/prefs')).body)
+    assert.equal(prefs.CorpDNS, false)
+    assert.equal(prefs.RouteAll, false)
+    assert.equal(prefs.Hostname, 'pinokio')
+    status.CertDomains = null
+    assert.equal((await cli.queryFeature()).URL, 'https://login.tailscale.com/f/serve?node=1')
+    status.CertDomains = ['pinokio.tail1.ts.net']
+
+    const kernel = {
+      platform: process.platform, homedir: tmp, server_port: 42000,
+      path: (...parts) => path.join(tmp, ...parts),
+      memory: { local: { [path.join(tmp, 'api/comfy/start.js')]: { url: 'http://127.0.0.1:7860' } } },
+      bin: { mod: { tailscaled: { installed: async () => true } } },
+    }
+    const anywhere = new Anywhere(kernel)
+    anywhere.readPid = () => 123 // The mock endpoint represents a verified owned daemon.
+    anywhere.api = cli
+    await anywhere.saveConfig({ enabled: true })
+    assert.equal((await anywhere.snapshot()).phase, 'ready', JSON.stringify({ config, seen }))
+    assert.equal(config.Web['pinokio.tail1.ts.net:443'].Handlers['/'].Proxy, 'http://127.0.0.1:42000')
+    assert.equal(config.Web['pinokio.tail1.ts.net:43000'].Handlers['/'].Proxy, 'http://127.0.0.1:7860')
+    assert.equal(config.AllowFunnel, undefined)
+    assert.equal(await anywhere.sync(), false, 'unchanged routes do not write')
+    const portMap = fs.readFileSync(anywhere.portMapPath(), 'utf8')
+    kernel.memory.local[path.join(tmp, 'api/comfy/start.js')].url = 'http://127.0.0.1:7861'
+    conflict = true
+    assert.equal((await anywhere.snapshot()).phase, 'error')
+    assert.equal(anywhere.rewriteHref('pinokio.tail1.ts.net', 'http://127.0.0.1:7861/'), 'http://127.0.0.1:7861/')
+    assert.equal(config.Web['pinokio.tail1.ts.net:43000'].Handlers['/'].Proxy, 'http://127.0.0.1:7860')
+    conflict = false
+    assert.equal((await anywhere.snapshot()).phase, 'ready')
+    assert.equal(fs.readFileSync(anywhere.portMapPath(), 'utf8'), portMap)
+    assert.equal(config.Web['pinokio.tail1.ts.net:43000'].Handlers['/'].Proxy, 'http://127.0.0.1:7861')
+    for (const [origin, expected] of [
+      ['https://127.0.0.1', 'https://127.0.0.1'],
+      ['https://localhost', 'https://localhost'],
+      ['http://[::1]', 'http://[::1]'],
+      ['http://0.0.0.0', 'http://127.0.0.1'],
+    ]) {
+      kernel.memory.local[path.join(tmp, 'api/comfy/start.js')].url = `${origin}:7861/ui/`
+      assert.equal((await anywhere.snapshot()).phase, 'ready')
+      assert.equal(config.Web['pinokio.tail1.ts.net:43000'].Handlers['/'].Proxy, `${expected}:7861`)
+    }
+    kernel.memory.local = {}
+    await anywhere.sync()
+    assert.deepEqual(Object.keys(config.TCP), ['443'])
+    assert.ok(seen.filter((r) => r.method === 'POST' && r.url.endsWith('/serve-config')).every((r) => /^v\d+$/.test(r.etag)))
+
+    for (const code of [401, 403, 503]) {
+      failure = code
+      await assert.rejects(() => cli.ping(), /control failure/, `HTTP ${code} is not absence`)
+    }
+    failure = 0
+    await cli.logout()
+    let gotLink
+    const link = new Promise((resolve) => { gotLink = resolve })
+    const pending = cli.up((update) => { if (update.AuthURL) gotLink(update.AuthURL) })
+    const completed = pending.catch((error) => error)
+    assert.equal(await link, 'https://login.tailscale.com/a/fresh1')
+    cli.cancel()
+    assert.equal((await completed).cancelled, true)
+    let gotFresh
+    const fresh = new Promise((resolve) => { gotFresh = resolve })
+    const retried = cli.up((update) => { if (update.AuthURL) gotFresh(update.AuthURL) }, true)
+    const retriedResult = retried.catch((error) => error)
+    assert.equal(await fresh, 'https://login.tailscale.com/a/fresh2')
+    status.BackendState = 'Running'
+    bus.write(JSON.stringify({ State: 6, SelfChange: { Key: 'nodekey:' + '01'.repeat(32) } }) + '\n')
+    assert.equal(typeof await retriedResult, 'string')
+  } finally {
+    cli.cancel()
+    for (const socket of connections) socket.destroy()
+    await new Promise((resolve) => server.close(resolve))
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})
+
+test('native daemon: setup, simultaneous start, adoption, stop and saved Off', {
+  skip: !binPath || !process.env.PINOKIO_TEST_TAILSCALED, timeout: 45000,
+}, async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-native-'))
+  const binDir = path.join(tmp, 'managed tools')
+  fs.mkdirSync(binDir)
+  const cliBin = path.join(binDir, path.basename(binPath))
+  const daemonBin = path.join(binDir, path.basename(process.env.PINOKIO_TEST_TAILSCALED))
+  fs.copyFileSync(binPath, cliBin)
+  fs.copyFileSync(process.env.PINOKIO_TEST_TAILSCALED, daemonBin)
+  const mod = new Tailscaled()
+  const kernel = {
+    platform: process.platform, homedir: tmp, path: (...parts) => path.join(tmp, ...parts),
+    bin: { mod: { tailscaled: mod }, installed: { conda: new Set(['tailscaled', 'tailscale']),
+      conda_versions: { tailscaled: '1.104.1', tailscale: '1.104.1' } } },
+  }
+  mod.kernel = kernel
+  mod.binPath = () => daemonBin
+  mod.cliPath = () => cliBin
+  const first = new Anywhere(kernel)
+  if (process.platform === 'win32') first._socketPath = `\\\\.\\pipe\\pinokio-native-test-${process.pid}`
+  let adopted
+  try {
+    assert.equal(await mod.installed(), true, 'both actual executable versions match')
+    await first.saveConfig({ enabled: true })
+    await Promise.all([first.start(), first.start(), first.start()])
+    assert.ok(first.child && first.child.pid)
+    const pid = first.child.pid
+    const statePath = first.stateDir('tailscaled.state')
+    // A fresh daemon must show sign-in or the pending CLI flow, never ready.
+    const snap = await first.snapshot()
+    assert.ok(['starting', 'login'].includes(snap.phase), JSON.stringify(snap))
+    const deadline = Date.now() + 15000
+    while (!first.login.url && !first.error && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, 100))
+    assert.ok(first.login.url, first.error || 'native login did not produce a URL within 15 seconds')
+    first.client().cancel()
+    if (first.login) await first.login.promise
+    adopted = new Anywhere(kernel)
+    adopted._socketPath = first.socketPath()
+    await adopted.start()
+    assert.equal(adopted.child, null, 'a second controller uses the existing endpoint')
+    assert.equal(first.child.pid, pid, 'no duplicate daemon')
+    assert.ok(fs.existsSync(statePath))
+    await adopted.disable()
+    assert.equal((await adopted.snapshot()).phase, 'off')
+    assert.equal(await adopted.autostart(), false)
+    assert.ok(fs.existsSync(statePath), 'disable retains node state')
+    assert.equal(await new TailscaleCLI({ binPath: cliBin, socketPath: first.socketPath() }).ping(), false)
+  } finally {
+    try { first.killSync() } catch (_) { }
+    try { if (adopted) adopted.killSync() } catch (_) { }
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})