pinokiod 8.2.18 → 8.2.20

package/kernel/bin/conda-pins.js

@@ -3,7 +3,7 @@ const path = require('path')
 const { resolveAsarPath } = require('../util')
 const PIP_WHEEL = require('../../system/pip_seed.json')
 
-const CONDA_PIN_VERSION = "26.5.3"
+const CONDA_PIN_VERSION = "26.7.0"
 // Conda 26.9.4 has no Python 3.10 builds. Apply its CA-bundle requirements
 // explicitly while retaining the managed Python version required by apps.
 const TLS_PACKAGE_MINIMUMS = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.2.18",
+  "version": "8.2.20",
   "description": "",
   "main": "index.js",
   "scripts": {

package/server/index.js

@@ -1037,7 +1037,7 @@ class Server {
     const entries = await this.kernel.api.listApps()
     return { apps: entries.map((entry) => ({ id: entry.id, name: entry.title || entry.name || entry.id, icon: entry.icon })) }
   }
-  // launch is a side effect: only pinokio.co and this computer may call it
+  // launch and stop are side effects: only pinokio.co and this computer may call them
   anywhereOriginAllowed(origin) {
     if (!origin) return true
     let parsed
@@ -1067,10 +1067,15 @@ class Server {
     }
     return items
   }
+  // the folder of an installed app, or "" for anything that is not exactly one folder name under api/
+  async anywhereAppDir(id) {
+    const dir = typeof id === "string" ? this.kernel.path("api", id) : ""
+    if (!dir || path.dirname(dir) !== this.kernel.path("api") || path.basename(dir) !== id) return ""
+    return (await this.kernel.api.exists(dir)) ? dir : ""
+  }
   async composeAnywhereLaunch({ id, href } = {}) {
     const api = this.kernel.api
-    const dir = typeof id === "string" ? this.kernel.path("api", id) : ""
-    if (!dir || path.dirname(dir) !== this.kernel.path("api") || path.basename(dir) !== id || !(await api.exists(dir))) {
+    if (!(await this.anywhereAppDir(id))) {
       return { status: 400, body: { error: `Unknown app: ${id}` } }
     }
     const menu = await this.anywhereMenu(api, await api.launcher_path(id))
@@ -1104,6 +1109,21 @@ class Server {
     }
     return { status: 200, body: { action: "started" } }
   }
+  // stops every run under the app's folder the way the desktop stops one (kernel.api.stop by its running key)
+  async composeAnywhereStop({ id } = {}) {
+    const api = this.kernel.api
+    const dir = await this.anywhereAppDir(id)
+    if (!dir) {
+      return { status: 400, body: { error: `Unknown app: ${id}` } }
+    }
+    for (const [key, value] of Object.entries(api.running || {})) {
+      const rel = path.relative(dir, key.split("?")[0])
+      if (value && rel && !rel.startsWith("..") && !path.isAbsolute(rel)) {
+        await api.stop({ params: { id: key } })
+      }
+    }
+    return { status: 200, body: { action: "stopped" } }
+  }
   async composeAnywhereStatus({ light } = {}) {
     const anywhere = this.kernel ? this.kernel.anywhere : null
     if (!anywhere) {
@@ -14349,19 +14369,22 @@ class Server {
       res.set("Cache-Control", "no-store")
       res.json(await this.composeAnywhereApps())
     }))
-    this.app.post("/anywhere/launch", ex(async (req, res) => {
+    // app actions change what runs on this computer: pinokio.co and this computer only
+    const anywhereAppAction = (fn) => ex(async (req, res) => {
       res.set("Cache-Control", "no-store")
       if (!this.anywhereOriginAllowed(req.get("Origin"))) {
-        res.status(403).json({ error: "Launching is allowed only from pinokio.co or this computer" })
+        res.status(403).json({ error: "Allowed only from pinokio.co or this computer" })
         return
       }
       try {
-        const { status, body } = await this.composeAnywhereLaunch(req.body || {})
+        const { status, body } = await fn(req.body || {})
         res.status(status).json(body)
       } catch (error) {
         res.status(500).json({ error: error && error.message ? error.message : String(error) })
       }
-    }))
+    })
+    this.app.post("/anywhere/apps/launch", anywhereAppAction((body) => this.composeAnywhereLaunch(body)))
+    this.app.post("/anywhere/apps/stop", anywhereAppAction((body) => this.composeAnywhereStop(body)))
     const anywhereAction = (label, fn) => ex(async (req, res) => {
       const anywhere = this.kernel.anywhere
       if (!anywhere) {

package/test/anywhere-api.test.js

@@ -110,7 +110,7 @@ test('the catalog maps installed apps to id, name and icon', async () => {
 // a launch harness: one app "comfy" at /managed/api/comfy whose menu is set per case;
 // kernel.status mirrors the kernel's session-aware running check
 const launchHarness = ({ menu = [], running = {}, anywhere = readyAnywhere() } = {}) => {
-  const calls = { process: [], cleared: [], reserved: [], counted: [] }
+  const calls = { process: [], cleared: [], reserved: [], counted: [], stopped: [] }
   const api = {
     exists: async (p) => p === '/managed/api/comfy',
     launcher_path: async (name) => `/managed/api/${name}`,
@@ -118,6 +118,7 @@ const launchHarness = ({ menu = [], running = {}, anywhere = readyAnywhere() } =
     running,
     logSessions: { reserveLaunch: async (uri) => { calls.reserved.push(uri) } },
     process: (req) => { calls.process.push(req); return Promise.resolve() },
+    stop: async (req) => { calls.stopped.push(req.params.id) },
   }
   const server = Object.assign(Object.create(Server.prototype), {
     kernel: {
@@ -128,7 +129,7 @@ const launchHarness = ({ menu = [], running = {}, anywhere = readyAnywhere() } =
     },
     appPreferences: { recordLaunchByPath: async (p, options) => { calls.counted.push([p, options.source]) } },
   })
-  return { server, calls, launch: (body) => server.composeAnywhereLaunch(body) }
+  return { server, calls, launch: (body) => server.composeAnywhereLaunch(body), stop: (body) => server.composeAnywhereStop(body) }
 }
 
 test('launch opens a loopback URL default at its Anywhere address, null until Serve carries it, other URLs as they are', async () => {
@@ -207,7 +208,32 @@ test('a drive-relative app id is refused on Windows', { skip: process.platform !
   }
 })
 
-test('launch is allowed from pinokio.co and this computer only', () => {
+test('stop ends every run under the app folder by its running key, and nothing else', async () => {
+  const running = {
+    '/managed/api/comfy/start.js': true,
+    '/managed/api/comfy/start.js&session=abc': true,
+    '/managed/api/comfy/sub/worker.js?cwd=/managed/api/comfy': true,
+    '/managed/api/comfy/old.js': false,
+    '/managed/api/comfyui/start.js': true,
+    '/managed/api/other/start.js': true,
+  }
+  const h = launchHarness({ running })
+  assert.deepEqual(await h.stop({ id: 'comfy' }), { status: 200, body: { action: 'stopped' } })
+  assert.deepEqual(h.calls.stopped, [
+    '/managed/api/comfy/start.js',
+    '/managed/api/comfy/start.js&session=abc',
+    '/managed/api/comfy/sub/worker.js?cwd=/managed/api/comfy',
+  ])
+  const idle = launchHarness()
+  assert.deepEqual(await idle.stop({ id: 'comfy' }), { status: 200, body: { action: 'stopped' } })
+  assert.deepEqual(idle.calls.stopped, [])
+  for (const id of ['nope', '../comfy', 'comfy/start.js', '', undefined]) {
+    assert.equal((await h.stop({ id })).status, 400, String(id))
+  }
+  assert.equal(h.calls.stopped.length, 3)
+})
+
+test('launch and stop are allowed from pinokio.co and this computer only', () => {
   const server = Object.assign(Object.create(Server.prototype), { kernel: { anywhere: readyAnywhere() } })
   for (const origin of [undefined, 'https://pinokio.co', 'http://localhost:42000', 'http://127.0.0.1:42000', 'https://pinokio.tail1.ts.net']) {
     assert.equal(server.anywhereOriginAllowed(origin), true, String(origin))

package/test/conda-bin.test.js

@@ -211,11 +211,12 @@ test('Conda uses Miniforge assets and writes conda-forge-only config', async ()
 })
 
 test('Conda pins the managed Conda and Python versions consistently', async () => {
-  assert.equal(CONDA_PIN_VERSION, '26.5.3')
+  assert.equal(CONDA_PIN_VERSION, '26.7.0')
   assert.equal(PYTHON_INSTALL_SPEC, 'python=3.10.20')
   assert.equal(WINDOWS_PYTHON_SSL_FIX_SPEC, 'python=3.10.20=*_1_cpython')
 
-  assert.equal(isExpectedCondaPinned('26.5.3'), true)
+  assert.equal(isExpectedCondaPinned('26.7.0'), true)
+  assert.equal(isExpectedCondaPinned('26.5.3'), false)
   assert.equal(isExpectedCondaPinned('26.3.2'), false)
 
   assert.equal(isExpectedPythonPinned('darwin', '3.10.20', 'cpython'), true)
@@ -235,7 +236,7 @@ test('Conda init writes the current Conda pin into an existing runtime', async (
 
   assert.equal(
     await fs.readFile(path.join(root, 'bin', 'miniforge', 'conda-meta', 'pinned'), 'utf8'),
-    ['conda ==26.5.3', ...TLS_PACKAGE_SPECS].join('\n')
+    ['conda ==26.7.0', ...TLS_PACKAGE_SPECS].join('\n')
   )
 })
 
@@ -290,11 +291,11 @@ test('Conda install requests the Python 3.10.20 pin on macOS/Linux', async () =>
   assert.deepEqual(condaInstall.message[2], { _: ['python', '-I', '-m', 'pip', '--isolated', 'install', '--no-index', PIP_WHEEL.filename] })
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
+    'conda install -y --override-channels -c conda-forge "conda=26.7.0" "python=3.10.20" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
   )
   assert.equal(
     await fs.readFile(path.join(root, 'bin', 'miniforge', 'conda-meta', 'pinned'), 'utf8'),
-    ['conda ==26.5.3', ...TLS_PACKAGE_SPECS].join('\n')
+    ['conda ==26.7.0', ...TLS_PACKAGE_SPECS].join('\n')
   )
 })
 
@@ -322,7 +323,7 @@ test('Conda install keeps the Windows Python 3.10.20 SSL-fixed build pin', async
   assert.ok(condaInstall)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20=*_1_cpython" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
+    'conda install -y --override-channels -c conda-forge "conda=26.7.0" "python=3.10.20=*_1_cpython" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
   )
 })
 
@@ -354,10 +355,73 @@ test('Conda install replaces the stale runtime and rebuilds declared Conda modul
   assert.ok(condaInstall)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19" uv=0.11.23 nodejs=22.21.1 pnpm'
+    'conda install -y --override-channels -c conda-forge "conda=26.7.0" "python=3.10.20" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19" uv=0.11.23 nodejs=22.21.1 pnpm'
   )
 })
 
+test('Conda 26.5.3 triggers replacement even when certificates and pip are current', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-version-update-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  for (const platform of ['darwin', 'linux', 'win32']) {
+    for (const securityReady of [false, true]) {
+      const dir = path.join(root, platform, String(securityReady))
+      await writeHealthyCondaMeta(dir, platform, '26.5.3')
+      await writeFakeManagedConda(dir, platform)
+      if (!securityReady) {
+        for (const name of ['ca-certificates', 'certifi']) {
+          await fs.rm(path.join(dir, 'bin/miniforge/conda-meta', `${name}-2026.10.19.json`))
+          await writeCondaMeta(dir, name, '2026.7.22')
+        }
+        await fs.writeFile(path.join(dir, 'bin/miniforge/test-pip-version'), '26.2.1')
+        await fs.rm(path.join(dir, 'bin/miniforge/test-pip-seed'))
+      }
+      const trash = path.join(dir, 'bin/miniforge/Library/bin/libcrypto-3-x64.dll.c~.conda_trash')
+      await fs.mkdir(path.dirname(trash), { recursive: true })
+      await fs.writeFile(trash, 'stale trash')
+      const appFile = path.join(dir, 'api/demo/env/keep.txt')
+      await fs.mkdir(path.dirname(appFile), { recursive: true })
+      await fs.writeFile(appFile, 'existing app venv')
+      const bin = createBin(dir, platform)
+      await bin.tryList()
+      assert.equal(bin.correct_conda, false)
+
+      const kernel = createKernel(dir, platform)
+      kernel.bin.mods = []
+      let downloads = 0
+      kernel.bin.download = async () => { downloads++ }
+      kernel.bin.rm = async () => {}
+      const calls = []
+      kernel.bin.exec = async payload => {
+        calls.push(payload)
+        if (payload.conda?.skip) {
+          assert.equal(await pathExists(trash), false, 'replacement removes old runtime and trash')
+          assert.equal(await pathExists(path.join(dir, 'bin/miniforge/conda-meta')), false)
+          await fs.mkdir(path.join(dir, 'bin/miniforge/conda-meta'), { recursive: true })
+          await writeFakeManagedConda(dir, platform)
+          if (platform === 'win32') await fs.writeFile(path.join(dir, 'bin/miniforge/python.exe'), 'fake python\n')
+        } else {
+          assert.match(payload.message[1], /"conda=26\.7\.0"/)
+          assert.deepEqual(payload.message[2], { _: ['python', '-I', '-m', 'pip', '--isolated', 'install', '--no-index', PIP_WHEEL.filename] })
+          await writeHealthyCondaMeta(dir, platform)
+        }
+        return {}
+      }
+      const conda = createConda(kernel)
+      await conda.install({ dependencies: [] }, () => {})
+      assert.equal(await conda.check(), true)
+      await bin.tryList()
+      assert.equal(bin.correct_conda, true)
+      assert.equal(await fs.readFile(appFile, 'utf8'), 'existing app venv')
+      assert.equal(await pathExists(trash), false)
+      assert.equal(downloads, 1)
+      assert.equal(calls.length, 2, 'installer and bootstrap run once')
+      await conda.install({ dependencies: [] }, () => {})
+      assert.equal(downloads, 1, 'the updated runtime is not reinstalled on a retry')
+      assert.equal(calls.length, 2)
+    }
+  }
+})
+
 test('Conda replacement stops a running managed Caddy without restoring it', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-caddy-lifecycle-'))
   await createMiniforge(root)