pinokiod 8.2.2 → 8.2.4

package/kernel/anywhere/localapi.js

@@ -0,0 +1,147 @@
+/*
+  Minimal client for the tailscaled LocalAPI.
+
+  tailscaled exposes an HTTP API over a unix socket (mac/linux) or a named
+  pipe (Windows). We talk to it with plain node `http` by passing the socket
+  path as `socketPath`; node's net layer handles both unix sockets and
+  `\\.\pipe\...` names. The conda-forge `tailscaled` package ships only the
+  daemon (no `tailscale` CLI), so every operation goes through this client.
+
+  Verified against tailscaled 1.104.1 (see spec/requirements/pinokio-anywhere.md):
+    GET   /localapi/v0/status                 -> ipnstate.Status JSON
+    GET   /localapi/v0/prefs                  -> ipn.Prefs JSON
+    PATCH /localapi/v0/prefs                  <- ipn.MaskedPrefs ({HostnameSet:true, Hostname:"pinokio", ...})
+    POST  /localapi/v0/login-interactive      -> 204; AuthURL shows up in /status and on the IPN bus (BrowseToURL)
+    POST  /localapi/v0/logout                 -> 204
+    GET   /localapi/v0/serve-config           -> ipn.ServeConfig JSON (or null) + Etag header
+    POST  /localapi/v0/serve-config           <- ipn.ServeConfig JSON, optional If-Match: <etag>
+    POST  /localapi/v0/query-feature?feature=serve -> {Complete, Text, URL} (URL = one-click tailnet approval)
+*/
+const http = require('http')
+
+class LocalAPIError extends Error {
+  constructor(message, status, body) {
+    super(message)
+    this.name = 'LocalAPIError'
+    this.status = status
+    this.body = body
+  }
+}
+
+class LocalAPI {
+  constructor({ socketPath, timeout = 10000 } = {}) {
+    if (!socketPath) {
+      throw new Error('LocalAPI requires a socketPath')
+    }
+    this.socketPath = socketPath
+    this.timeout = timeout
+    this.base = '/localapi/v0'
+  }
+  request(method, route, { body, headers, timeout } = {}) {
+    const payload = typeof body === 'undefined' || body === null
+      ? null
+      : (typeof body === 'string' || Buffer.isBuffer(body) ? body : JSON.stringify(body))
+    const reqHeaders = Object.assign({
+      // tailscaled rejects non-loopback origins without this on some
+      // transports (the Windows GUI loopback port); harmless on sockets.
+      'Sec-Tailscale': 'localapi',
+      'Host': 'local-tailscaled.sock',
+    }, headers || {})
+    if (payload !== null) {
+      reqHeaders['Content-Type'] = reqHeaders['Content-Type'] || 'application/json'
+      reqHeaders['Content-Length'] = Buffer.byteLength(payload)
+    }
+    return new Promise((resolve, reject) => {
+      const req = http.request({
+        socketPath: this.socketPath,
+        method,
+        path: this.base + route,
+        headers: reqHeaders,
+      }, (res) => {
+        const chunks = []
+        res.on('data', (chunk) => chunks.push(chunk))
+        res.on('end', () => {
+          const text = Buffer.concat(chunks).toString('utf8')
+          resolve({
+            status: res.statusCode,
+            headers: res.headers,
+            text,
+            json: () => {
+              if (!text || !text.trim()) return null
+              return JSON.parse(text)
+            },
+          })
+        })
+        res.on('error', reject)
+      })
+      req.setTimeout(timeout || this.timeout, () => {
+        req.destroy(new Error(`LocalAPI ${method} ${route} timed out`))
+      })
+      req.on('error', reject)
+      if (payload !== null) {
+        req.write(payload)
+      }
+      req.end()
+    })
+  }
+  async expect(method, route, options, okStatuses = [200, 204]) {
+    const res = await this.request(method, route, options)
+    if (!okStatuses.includes(res.status)) {
+      throw new LocalAPIError(`LocalAPI ${method} ${route} failed: ${res.status} ${res.text.trim()}`, res.status, res.text)
+    }
+    return res
+  }
+  async status() {
+    const res = await this.expect('GET', '/status')
+    return res.json()
+  }
+  // masked: an ipn.MaskedPrefs object, e.g. { HostnameSet: true, Hostname: 'pinokio' }
+  async patchPrefs(masked) {
+    const res = await this.expect('PATCH', '/prefs', { body: masked })
+    return res.json()
+  }
+  async loginInteractive() {
+    await this.expect('POST', '/login-interactive', { body: '' })
+    return true
+  }
+  async logout() {
+    await this.expect('POST', '/logout', { body: '' })
+    return true
+  }
+  // Restarts the backend's login state machine (what `tailscale up --force-reauth`
+  // does): a stale or invalidated login URL is dropped and a fresh one is minted
+  // on the next login-interactive.
+  async start(options = {}) {
+    await this.expect('POST', '/start', { body: options })
+    return true
+  }
+  async serveConfig() {
+    const res = await this.expect('GET', '/serve-config')
+    return { config: res.json(), etag: res.headers.etag || res.headers.Etag || null }
+  }
+  async setServeConfig(config, etag) {
+    const headers = {}
+    if (etag) {
+      headers['If-Match'] = etag
+    }
+    await this.expect('POST', '/serve-config', { body: config || {}, headers })
+    return true
+  }
+  async queryFeature(feature) {
+    const res = await this.request('POST', `/query-feature?feature=${encodeURIComponent(feature)}`, { body: '' })
+    if (res.status !== 200) {
+      throw new LocalAPIError(`query-feature ${feature} failed: ${res.status} ${res.text.trim()}`, res.status, res.text)
+    }
+    return res.json()
+  }
+  async ping() {
+    try {
+      const res = await this.request('GET', '/status', { timeout: 2000 })
+      return res.status === 200
+    } catch (e) {
+      return false
+    }
+  }
+}
+
+module.exports = { LocalAPI, LocalAPIError }

package/kernel/anywhere/ports.js

@@ -0,0 +1,51 @@
+/*
+  Stable remote ports for Pinokio Anywhere.
+
+  An app may bind a different local port from one launch to the next, but its
+  Tailscale address must not move: bookmarks, home-screen icons and links all
+  point at https://<node>.<tailnet>.ts.net:<port>. So every app is given a
+  remote port once, kept in ~/pinokio/anywhere/ports.json, and Serve maps that
+  fixed port to whatever local port the app has right now.
+
+  Remote ports live inside tailscaled's own network stack, so they never need
+  to be free on the machine itself.
+*/
+const fs = require('fs')
+const path = require('path')
+
+const FIRST_PORT = 43000
+const LAST_PORT = 43999
+
+async function loadPortMap(file) {
+  try {
+    const map = JSON.parse(await fs.promises.readFile(file, 'utf8'))
+    return map && typeof map === 'object' && !Array.isArray(map) ? map : {}
+  } catch (_) {
+    return {}
+  }
+}
+
+async function savePortMap(file, map) {
+  await fs.promises.mkdir(path.dirname(file), { recursive: true })
+  await fs.promises.writeFile(file, JSON.stringify(map, null, 2))
+}
+
+// Returns a copy of `map` with a port for every key, giving new keys the
+// lowest port not already taken. Existing assignments are never changed.
+function assignPorts(map, keys) {
+  const out = Object.assign({}, map)
+  const used = new Set(Object.values(out).map(Number))
+  let next = FIRST_PORT
+  let changed = false
+  for (const key of keys) {
+    if (Number.isInteger(out[key])) continue
+    while (used.has(next)) next += 1
+    if (next > LAST_PORT) throw new Error('Pinokio Anywhere has no free remote ports left')
+    out[key] = next
+    used.add(next)
+    changed = true
+  }
+  return { map: out, changed }
+}
+
+module.exports = { loadPortMap, savePortMap, assignPorts }

package/kernel/anywhere/serve.js

@@ -0,0 +1,95 @@
+/*
+  Builds the ipn.ServeConfig that tailscaled needs so pinokiod and each running
+  Pinokio app are reachable over HTTPS at a fixed address.
+
+  MagicDNS has no subdomains, so routes are per port. The remote port is the
+  app's stable port (see ports.js), the target is whatever local port the app
+  has right now:
+
+    https://pinokio.<tailnet>.ts.net         -> http://127.0.0.1:<pinokiod port>
+    https://pinokio.<tailnet>.ts.net:43000   -> http://127.0.0.1:7860   (comfy)
+    https://pinokio.<tailnet>.ts.net:43001   -> http://127.0.0.1:8188   (forge)
+
+  Serve-only: no AllowFunnel entries are ever emitted, so nothing is public.
+*/
+
+const DEFAULT_HTTPS_PORT = 443
+
+function normalizePort(value) {
+  const port = Number(value)
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    return null
+  }
+  return port
+}
+
+/*
+  options:
+    dnsName    "pinokio.tail1234.ts.net" (no trailing dot)
+    serverPort pinokiod's own port (mapped to :443)
+    targets    [{ listen, target }]: remote port -> local port
+*/
+function buildServeConfig({ dnsName, serverPort, targets = [] } = {}) {
+  const host = String(dnsName || '').replace(/\.$/, '')
+  if (!host) {
+    throw new Error('buildServeConfig requires dnsName')
+  }
+  const config = { TCP: {}, Web: {} }
+  const add = (listenPort, targetPort) => {
+    config.TCP[String(listenPort)] = { HTTPS: true }
+    config.Web[`${host}:${listenPort}`] = {
+      Handlers: {
+        '/': { Proxy: `http://127.0.0.1:${targetPort}` }
+      }
+    }
+  }
+  const server = normalizePort(serverPort)
+  if (server) {
+    add(DEFAULT_HTTPS_PORT, server)
+  }
+  const seen = new Set([DEFAULT_HTTPS_PORT])
+  const entries = []
+  for (const raw of targets) {
+    const listen = normalizePort(raw && raw.listen)
+    const target = normalizePort(raw && raw.target)
+    if (!listen || !target || seen.has(listen)) continue
+    seen.add(listen)
+    entries.push({ listen, target })
+  }
+  // deterministic key order so unchanged mappings compare equal
+  for (const entry of entries.sort((a, b) => a.listen - b.listen)) {
+    add(entry.listen, entry.target)
+  }
+  return config
+}
+
+// Lists what a serve config exposes: [{ port, local, target, url, name }]
+// `names` maps a remote port to the app name it was assigned to.
+function describeServeConfig(config, dnsName, names = {}) {
+  const host = String(dnsName || '').replace(/\.$/, '')
+  const out = []
+  if (!config || !config.Web) return out
+  for (const key of Object.keys(config.Web)) {
+    const match = key.match(/^(.*):(\d+)$/)
+    if (!match) continue
+    const port = Number(match[2])
+    const handlers = config.Web[key].Handlers || {}
+    const root = handlers['/'] || {}
+    const local = root.Proxy ? Number((String(root.Proxy).match(/:(\d+)$/) || [])[1]) || null : null
+    out.push({
+      port,
+      local,
+      target: root.Proxy || null,
+      url: port === DEFAULT_HTTPS_PORT ? `https://${host || match[1]}` : `https://${host || match[1]}:${port}`,
+      name: names[port] || null,
+    })
+  }
+  out.sort((a, b) => a.port - b.port)
+  return out
+}
+
+function sameServeConfig(a, b) {
+  return JSON.stringify(a || null) === JSON.stringify(b || null)
+}
+
+module.exports = { buildServeConfig, describeServeConfig, sameServeConfig, DEFAULT_HTTPS_PORT }

package/kernel/bin/bun.js

@@ -1,7 +1,7 @@
 const semver = require("semver")
 const Util = require("../util")
 
-const BUN_VERSION = "1.3.11"
+const BUN_VERSION = "1.4.4"
 
 class Bun {
   description = "Installs Bun, a fast JavaScript runtime and package manager."

package/kernel/bin/conda-meta.js

@@ -2,6 +2,8 @@ const fs = require('fs')
 const path = require('path')
 const { execFile } = require('child_process')
 const { managedPythonEnv } = require('../python_env')
+const semver = require('semver')
+const { PIP_MIN_VERSION } = require('./conda-pins')
 
 async function buildCondaListFromMeta(minicondaPath, useCondaList) {
   if (!useCondaList) {
@@ -108,7 +110,20 @@ function resolveCondaBinary(minicondaPath, platform = process.platform, allowFal
   return allowFallback ? 'conda' : null
 }
 
+async function hasSecureManagedPip(prefix, platform = process.platform) {
+  const python = path.join(prefix, platform === 'win32' ? 'python.exe' : 'bin/python')
+  return await new Promise(resolve => {
+    execFile(python, ['-I', '-c', 'from importlib.metadata import version; print(version("pip"))'], {
+      env: managedPythonEnv(), windowsHide: true, timeout: 15000,
+    }, (error, stdout) => {
+      const version = !error && semver.valid(String(stdout).trim())
+      resolve(!!version && semver.gte(version, PIP_MIN_VERSION))
+    })
+  })
+}
+
 module.exports = {
   buildCondaListFromMeta,
   managedCondaRuns,
+  hasSecureManagedPip,
 }

package/kernel/bin/conda-pins.js

@@ -1,6 +1,22 @@
 const semver = require('semver')
 
 const CONDA_PIN_VERSION = "26.5.3"
+// Conda 26.9.4 has no Python 3.10 builds. Apply its CA-bundle requirements
+// explicitly while retaining the managed Python version required by apps.
+const TLS_PACKAGE_MINIMUMS = {
+  'ca-certificates': '2026.10.19',
+  certifi: '2026.10.19',
+}
+// conda-forge's patched pip requires Python 3.11; this official wheel supports 3.10.
+// Bootstrap URL and hash: https://discuss.python.org/t/109576
+const PIP_MIN_VERSION = '26.2.2'
+const PIP_INSTALL_SPEC = 'pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70'
+const PIP_INSTALL_COMMAND = `python -I -m pip --isolated --disable-pip-version-check install --no-index --no-deps "${PIP_INSTALL_SPEC}"`
+const TLS_PACKAGE_SPECS = Object.entries(TLS_PACKAGE_MINIMUMS).map(([name, version]) => `${name}>=${version}`)
+const hasSecureTlsPackages = (versions = {}) => Object.entries(TLS_PACKAGE_MINIMUMS).every(([name, minimum]) => {
+  const version = semver.coerce(versions[name])
+  return version && semver.gte(version, minimum)
+})
 const PYTHON_PIN_VERSION = "3.10.20"
 const PYTHON_INSTALL_SPEC = `python=${PYTHON_PIN_VERSION}`
 const WINDOWS_PYTHON_SSL_FIX_SPEC = `${PYTHON_INSTALL_SPEC}=*_1_cpython`
@@ -30,6 +46,12 @@ const isExpectedPythonPinned = (platform, version, build) => {
 
 module.exports = {
   CONDA_PIN_VERSION,
+  TLS_PACKAGE_MINIMUMS,
+  PIP_MIN_VERSION,
+  PIP_INSTALL_SPEC,
+  PIP_INSTALL_COMMAND,
+  TLS_PACKAGE_SPECS,
+  hasSecureTlsPackages,
   PYTHON_INSTALL_SPEC,
   WINDOWS_PYTHON_SSL_FIX_SPEC,
   isExpectedCondaPinned,

package/kernel/bin/conda.js

@@ -1,18 +1,37 @@
 const fs = require('fs')
 const { glob } = require('glob')
 const semver = require('semver')
+const { createHash } = require('crypto')
+const { execFile } = require('child_process')
+const { managedPythonEnv } = require('../python_env')
 const { isPathRemovalBlockedError, removePath } = require('../path_removal')
-const { buildCondaListFromMeta, managedCondaRuns } = require('./conda-meta')
+const { buildCondaListFromMeta, managedCondaRuns, hasSecureManagedPip } = require('./conda-meta')
 const {
   CONDA_PIN_VERSION,
+  PIP_INSTALL_COMMAND,
+  TLS_PACKAGE_MINIMUMS,
+  TLS_PACKAGE_SPECS,
+  hasSecureTlsPackages,
   PYTHON_INSTALL_SPEC,
   WINDOWS_PYTHON_SSL_FIX_SPEC,
   isExpectedCondaPinned,
   isExpectedPythonPinned,
 } = require('./conda-pins')
 
-const MINIFORGE_RELEASE = "26.3.2-3"
+const MINIFORGE_RELEASE = "26.9.4-0"
 const MINIFORGE_BASE_URL = `https://github.com/conda-forge/miniforge/releases/download/${MINIFORGE_RELEASE}`
+// GitHub's published SHA-256 asset digests for Miniforge 26.9.4-0.
+const MINIFORGE_SHA256 = {
+  darwin: {
+    x64: '4bf8d162f90a9ae79fbe1c3b152a9957b6cf4e7385758fa21e0340229d444df1',
+    arm64: '85512f5495465644e09655d84bc1df79d978353abd9ef0d0a8f3df75da44c760',
+  },
+  linux: {
+    x64: '621428f40496a90702753b09237794518a081d9979d9f845a525de761b6056f7',
+    arm64: 'd265b10be348403a3bb8d475ff989beba48db9baa5fe7ee28eb38213538056bb',
+  },
+  win32: { x64: '43638698f5ee811debae27b0dc3ab5c0300129bd400a847376c4bd2f6be15ceb' },
+}
 const CONDA_ROOT_DIR = "miniforge"
 const LEGACY_CONDA_ROOT_DIR = "miniconda"
 
@@ -44,11 +63,22 @@ class Conda {
   pinnedPackages() {
     return [
       `conda ==${CONDA_PIN_VERSION}`,
+      ...TLS_PACKAGE_SPECS,
     ].join("\n")
   }
   async hasCondaMeta() {
     return await this.kernel.exists(`bin/${CONDA_ROOT_DIR}/conda-meta`)
   }
+  async verifyInstaller(installer) {
+    const expected = MINIFORGE_SHA256[this.kernel.platform]?.[this.kernel.arch]
+    const hash = createHash('sha256')
+    for await (const chunk of fs.createReadStream(this.kernel.bin.path(installer))) {
+      hash.update(chunk)
+    }
+    if (!expected || hash.digest('hex') !== expected) {
+      throw new Error('Miniforge installer SHA-256 verification failed. The installer was not run and existing environments were preserved.')
+    }
+  }
   env() {
     let base = {
       CONDA_PREFIX: this.kernel.bin.path(CONDA_ROOT_DIR),
@@ -78,6 +108,7 @@ class Conda {
 channel_priority: flexible
 create_default_packages:
   - ${PYTHON_INSTALL_SPEC}
+${TLS_PACKAGE_SPECS.map(spec => `  - ${spec}`).join("\n")}
 envs_dirs:
   - ${this.kernel.bin.path(`${CONDA_ROOT_DIR}/envs`)}
 pkgs_dirs:
@@ -138,12 +169,37 @@ report_errors: false`)
     this.kernel.bin.installed.conda = conda
     this.kernel.bin.installed.conda_versions = conda_versions
     this.kernel.bin.installed.conda_builds = conda_builds
-    if (!(conda_check.conda && conda_check.mamba && conda_check.python)) {
+    if (!(conda_check.conda && conda_check.mamba && conda_check.python && hasSecureTlsPackages(conda_versions))) {
       return false
     }
-    return await managedCondaRuns(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.platform)
+    return await hasSecureManagedPip(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.platform) && await managedCondaRuns(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.platform)
   }
   async install(req, ondata) {
+    await this.check()
+    const { conda_versions: versions, conda_builds: builds } = this.kernel.bin.installed
+    if (isExpectedCondaPinned(versions.conda) &&
+        isExpectedPythonPinned(this.kernel.platform, versions.python, builds.python) &&
+        await managedCondaRuns(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.platform)) {
+      // Refresh a working runtime in place, preserving named app environments.
+      await this.init()
+      const bootstrap = await this.kernel.bin.exec({
+        message: [PIP_INSTALL_COMMAND, `python -I -m pip --isolated install --no-deps --only-binary=:all: --index-url https://pypi.org/simple "certifi>=${TLS_PACKAGE_MINIMUMS.certifi}"`],
+      }, ondata)
+      if (bootstrap?.error?.length) throw new Error("Conda certificate bootstrap failed; existing environments were preserved.")
+      const python = this.kernel.bin.path(CONDA_ROOT_DIR, this.kernel.platform === 'win32' ? 'python.exe' : 'bin/python')
+      const output = await new Promise((resolve, reject) => execFile(python,
+        ['-I', '-c', 'import certifi; from importlib.metadata import version; print(certifi.where()); print(version("certifi"))'],
+        { env: managedPythonEnv(), windowsHide: true, timeout: 15000 },
+        (error, stdout) => error ? reject(error) : resolve(stdout.trim())))
+      const [caFile, certifiVersion] = output.split(/[\r\n]+/)
+      if (!semver.valid(certifiVersion) || !semver.gte(certifiVersion, TLS_PACKAGE_MINIMUMS.certifi)) throw new Error("The certificate bootstrap did not complete.")
+      const result = await this.kernel.bin.exec({
+        message: [`conda install -y --override-channels -c conda-forge "${this.kernel.platform === "win32" ? WINDOWS_PYTHON_SSL_FIX_SPEC : PYTHON_INSTALL_SPEC}" "conda-libmamba-solver>=25.4.0" pip ${TLS_PACKAGE_SPECS.map(spec => `"${spec}"`).join(" ")}`, PIP_INSTALL_COMMAND],
+        env: { CONDA_SSL_VERIFY: caFile },
+      }, ondata)
+      if (result?.error?.length || !(await this.check())) throw new Error("Conda certificate update failed; existing environments were preserved.")
+      return
+    }
     for(let i=0; i<5; i++) {
       await this._install(req, ondata)
       let installed = await this.check()
@@ -170,6 +226,7 @@ report_errors: false`)
 
     ondata({ raw: `downloading installer: ${installer_url}...\r\n` })
     await this.kernel.bin.download(installer_url, installer, ondata)
+    await this.verifyInstaller(installer)
 
     const caddy = this.kernel.bin.mod && this.kernel.bin.mod.caddy
     if (caddy && typeof caddy.running === "function" && await caddy.running()) {
@@ -227,13 +284,16 @@ report_errors: false`)
       `"conda=${CONDA_PIN_VERSION}"`,
       this.kernel.platform === "win32" ? `"${WINDOWS_PYTHON_SSL_FIX_SPEC}"` : `"${PYTHON_INSTALL_SPEC}"`,
       `"conda-libmamba-solver>=25.4.0"`,
+      "pip",
+      ...TLS_PACKAGE_SPECS.map(spec => `"${spec}"`),
     ]
 
     let cmds = [
       "conda clean -y --all",
       `conda install -y --override-channels -c conda-forge ${condaPackages.join(" ")} ${mods}`.trim(),
+      PIP_INSTALL_COMMAND,
     ]
-    await this.kernel.bin.exec({
+    const result = await this.kernel.bin.exec({
       message: cmds,
       env: {
         PIP_REQUIRE_VIRTUALENV: "false"
@@ -241,6 +301,7 @@ report_errors: false`)
     }, (stream) => {
       ondata(stream)
     })
+    if (result?.error?.length) throw new Error("Conda package or pip installation failed.")
     if (this.kernel.platform === "win32") {
       // copy python.exe to python3.exe so you can run with both python3 and python
       await fs.promises.copyFile(

package/kernel/bin/index.js

@@ -21,10 +21,11 @@ const LLVM = require('./llvm')
 const VS = require("./vs")
 const Cuda = require("./cuda")
 const Torch = require("./torch")
-const { buildCondaListFromMeta, managedCondaRuns } = require('./conda-meta')
+const { buildCondaListFromMeta, managedCondaRuns, hasSecureManagedPip } = require('./conda-meta')
 const {
   isExpectedCondaPinned,
   isExpectedPythonPinned,
+  hasSecureTlsPackages,
 } = require('./conda-pins')
 const { glob } = require('glob')
 const fakeUa = require('fake-useragent');
@@ -412,8 +413,8 @@ class Bin {
         }
       }
 
-      if (conda_check.conda && conda_check.mamba && conda_check.python) {
-        this.correct_conda = await managedCondaRuns(this.kernel.bin.path("miniforge"), this.platform)
+      if (conda_check.conda && conda_check.mamba && conda_check.python && hasSecureTlsPackages(conda_versions)) {
+        this.correct_conda = await hasSecureManagedPip(this.kernel.bin.path("miniforge"), this.platform) && await managedCondaRuns(this.kernel.bin.path("miniforge"), this.platform)
       }
     }
     this.installed.conda = conda

package/kernel/bin/node.js

@@ -2,7 +2,7 @@ const fs = require('fs')
 const fetch = require('cross-fetch')
 const { rimraf } = require('rimraf')
 const decompress = require('decompress');
-const NODE_VERSION = "24.18.0"
+const NODE_VERSION = "24.22.1"
 const PNPM_VERSION = "11.9.0"
 
 const normalizeVersion = (version) => {

package/kernel/bin/setup.js

@@ -270,6 +270,35 @@ module.exports = {
       ]
     }
   },
+  anywhere: (kernel) => {
+    let requirements = [
+      { name: "conda", },
+      { name: "zip", },
+    ]
+    if (platform === "darwin") {
+      requirements.push({ name: "brew" })
+    }
+    requirements = requirements.concat([
+      { name: "git", },
+      { name: "uv", },
+      { name: "node", },
+      { name: "tailscaled", },
+      { name: "py" },
+      { name: "bluefairy" },
+    ])
+    return {
+      icon: "fa-solid fa-mobile-screen",
+      title: "Pinokio Anywhere",
+      description: "Reach this Pinokio and its apps from your phone or another computer over a private Tailscale network",
+      requirements,
+      conda_requirements: [
+        zip_cmd,
+        "uv",
+        "git",
+        "tailscaled"
+      ]
+    }
+  },
   connect: (kernel) => {
     let requirements = [
       { name: "conda", },

package/kernel/bin/tailscaled.js

@@ -0,0 +1,72 @@
+const path = require('path')
+const semver = require('semver')
+
+// conda-forge ships only the daemon binary (no `tailscale` CLI); Pinokio
+// drives it over its LocalAPI (see kernel/anywhere).
+const TAILSCALED_SPEC = "tailscaled=1.104.2"
+const TAILSCALED_REQUIREMENT = ">=1.104.2"   // Blocks the compromised eMudhra intermediate keys.
+
+class Tailscaled {
+  description = "Installs the Tailscale daemon for Pinokio Anywhere: reach this Pinokio and its apps from your phone or another computer over a private network."
+  cmd() {
+    return TAILSCALED_SPEC
+  }
+  binPath() {
+    if (this.kernel.platform === "win32") {
+      return this.kernel.bin.path("miniforge", "Library", "bin", "tailscaled.exe")
+    }
+    return this.kernel.bin.path("miniforge", "bin", "tailscaled")
+  }
+  async install(req, ondata) {
+    if (this.kernel.anywhere) await this.kernel.anywhere.stop()
+    await this.kernel.bin.exec({
+      message: [
+        // a stale libmamba index cache reports the package as missing even
+        // though `conda search` sees it; clearing just the index fixes that.
+        "conda clean -y -i",
+        `conda install -y --override-channels -c conda-forge ${this.cmd()}`
+      ]
+    }, ondata)
+  }
+  async installed() {
+    try {
+      const conda = this.kernel.bin.installed && this.kernel.bin.installed.conda
+      if (!conda || !conda.has("tailscaled")) {
+        return false
+      }
+      const versions = this.kernel.bin.installed.conda_versions || {}
+      const coerced = semver.coerce(versions.tailscaled)
+      if (!coerced) {
+        return false
+      }
+      return semver.satisfies(coerced, TAILSCALED_REQUIREMENT)
+    } catch (e) {
+      console.log("tailscaled installed check error", e)
+      return false
+    }
+  }
+  // Called by kernel.bin.init() for every module: resume the daemon when the
+  // user had Pinokio Anywhere switched on.
+  async start() {
+    const anywhere = this.kernel.anywhere
+    if (!anywhere || typeof anywhere.autostart !== "function") {
+      return
+    }
+    // not awaited: a slow or broken daemon must not hold up the rest of bin init
+    anywhere.autostart().catch((e) => {
+      console.log("[anywhere] autostart failed", e && e.message ? e.message : e)
+    })
+  }
+  async uninstall(req, ondata) {
+    ondata({ raw: "stopping Pinokio Anywhere\r\n" })
+    if (this.kernel.anywhere && typeof this.kernel.anywhere.stop === "function") {
+      await this.kernel.anywhere.stop().catch(() => {})
+    }
+    ondata({ raw: "cleaning up\r\n" })
+    await this.kernel.bin.exec({
+      message: `conda remove -y tailscaled`,
+    }, ondata)
+    ondata({ raw: "finished cleaning up\r\n" })
+  }
+}
+module.exports = Tailscaled

package/kernel/bin/uv.js

@@ -1,4 +1,4 @@
-const UV_VERSION = "0.11.23"
+const UV_VERSION = "0.13.4"
 
 const normalizeVersion = (version) => {
   const match = String(version || "").match(/^\d+\.\d+\.\d+/)