pinokiod 8.2.2 → 8.2.4

package/test/anywhere.test.js

@@ -0,0 +1,461 @@
+const assert = require('node:assert/strict')
+const test = require('node:test')
+const http = require('node:http')
+const os = require('node:os')
+const fs = require('node:fs')
+const path = require('node:path')
+
+const { buildServeConfig, describeServeConfig, sameServeConfig } = require('../kernel/anywhere/serve')
+const { assignPorts } = require('../kernel/anywhere/ports')
+const { LocalAPI } = require('../kernel/anywhere/localapi')
+const Anywhere = require('../kernel/anywhere')
+const { spawn } = require('node:child_process')
+const Tailscaled = require('../kernel/bin/tailscaled')
+const Setup = require('../kernel/bin/setup')
+
+test('serve config maps pinokiod to 443 and each app to its stable remote port', () => {
+  const config = buildServeConfig({
+    dnsName: 'pinokio.tail1234.ts.net.',
+    serverPort: 42000,
+    targets: [{ listen: 43001, target: 8188 }, { listen: 43000, target: 7860 }, { listen: 43000, target: 9999 }, { listen: 443, target: 1 }, { listen: 'nope', target: 1 }, { listen: 43002, target: 70000 }],
+  })
+  assert.deepEqual(Object.keys(config.TCP), ['443', '43000', '43001'])
+  assert.equal(config.TCP['43000'].HTTPS, true)
+  assert.equal(config.Web['pinokio.tail1234.ts.net:443'].Handlers['/'].Proxy, 'http://127.0.0.1:42000')
+  assert.equal(config.Web['pinokio.tail1234.ts.net:43000'].Handlers['/'].Proxy, 'http://127.0.0.1:7860')
+  assert.equal(config.Web['pinokio.tail1234.ts.net:43001'].Handlers['/'].Proxy, 'http://127.0.0.1:8188')
+  assert.equal(config.AllowFunnel, undefined, 'serve-only: never emits funnel entries')
+
+  const described = describeServeConfig(config, 'pinokio.tail1234.ts.net', { 43000: 'comfy' })
+  assert.deepEqual(described.map((d) => [d.url, d.local, d.name]), [
+    ['https://pinokio.tail1234.ts.net', 42000, null],
+    ['https://pinokio.tail1234.ts.net:43000', 7860, 'comfy'],
+    ['https://pinokio.tail1234.ts.net:43001', 8188, null],
+  ])
+  const same = buildServeConfig({ dnsName: 'pinokio.tail1234.ts.net', serverPort: 42000, targets: [{ listen: 43000, target: 7860 }, { listen: 43001, target: 8188 }] })
+  assert.equal(sameServeConfig(config, same), true, 'order of targets does not matter')
+  const relaunched = buildServeConfig({ dnsName: 'pinokio.tail1234.ts.net', serverPort: 42000, targets: [{ listen: 43000, target: 7861 }, { listen: 43001, target: 8188 }] })
+  assert.equal(sameServeConfig(config, relaunched), false, 'a new local port changes the mapping but not the address')
+  assert.equal(describeServeConfig(relaunched, 'pinokio.tail1234.ts.net')[1].url, 'https://pinokio.tail1234.ts.net:43000')
+})
+
+test('stable ports are allocated once, lowest free first, and never move', () => {
+  let r = assignPorts({}, ['comfy', 'forge'])
+  assert.deepEqual(r.map, { comfy: 43000, forge: 43001 })
+  assert.equal(r.changed, true)
+  r = assignPorts(r.map, ['forge', 'webui'])
+  assert.deepEqual(r.map, { comfy: 43000, forge: 43001, webui: 43002 })
+  r = assignPorts(r.map, ['forge'])
+  assert.equal(r.changed, false, 'known apps need no write')
+  assert.equal(assignPorts({ a: 43000, b: 43002 }, ['c']).map.c, 43001, 'gaps are reused')
+})
+
+test('anywhere preset requires tailscaled but not caddy', () => {
+  const preset = Setup.anywhere({})
+  const names = preset.requirements.map((r) => r.name)
+  assert.ok(names.includes('tailscaled'))
+  assert.ok(!names.includes('caddy'))
+  assert.ok(preset.conda_requirements.includes('tailscaled'))
+  assert.ok(!preset.conda_requirements.includes('caddy'))
+})
+
+test('tailscaled bin module pins 1.104.2 and checks the installed version', async () => {
+  const mod = new Tailscaled()
+  assert.equal(mod.cmd(), 'tailscaled=1.104.2')
+  mod.kernel = {
+    platform: 'darwin',
+    bin: {
+      installed: { conda: new Set(['tailscaled']), conda_versions: { tailscaled: '1.104.2' } },
+      path: (...segments) => segments.join('/'),
+    },
+  }
+  assert.equal(await mod.installed(), true)
+  mod.kernel.bin.installed.conda_versions.tailscaled = '1.104.1'
+  assert.equal(await mod.installed(), false)
+  mod.kernel.bin.installed.conda_versions.tailscaled = '1.104.2'
+  assert.equal(mod.binPath(), 'miniforge/bin/tailscaled')
+  mod.kernel.bin.installed.conda_versions.tailscaled = '1.98.5'
+  assert.equal(await mod.installed(), false, 'older than 1.104 (no --windows-mode=dev) is not accepted')
+  mod.kernel.bin.installed.conda = new Set()
+  assert.equal(await mod.installed(), false)
+  mod.kernel.platform = 'win32'
+  assert.equal(mod.binPath(), 'miniforge/Library/bin/tailscaled.exe')
+})
+
+function withMockDaemon(handler, fn) {
+  const socketPath = path.join(os.tmpdir(), `pk-ts-test-${process.pid}-${Date.now()}.sock`)
+  const server = http.createServer(handler)
+  return new Promise((resolve, reject) => {
+    server.listen(socketPath, async () => {
+      try {
+        resolve(await fn(socketPath))
+      } catch (e) {
+        reject(e)
+      } finally {
+        server.close()
+        fs.rmSync(socketPath, { force: true })
+      }
+    })
+  })
+}
+
+test('LocalAPI client talks plain HTTP over the socket with the Sec-Tailscale header', { skip: process.platform === 'win32' }, async () => {
+  const seen = []
+  await withMockDaemon((req, res) => {
+    let body = ''
+    req.on('data', (c) => body += c)
+    req.on('end', () => {
+      seen.push({ method: req.method, url: req.url, sec: req.headers['sec-tailscale'], ifMatch: req.headers['if-match'], body })
+      if (req.url === '/localapi/v0/status') {
+        res.setHeader('Content-Type', 'application/json')
+        res.end(JSON.stringify({ BackendState: 'Running', Self: { DNSName: 'pinokio.tail1.ts.net.' } }))
+      } else if (req.url === '/localapi/v0/serve-config' && req.method === 'GET') {
+        res.setHeader('Etag', 'abc')
+        res.end('null')
+      } else if (req.url === '/localapi/v0/serve-config' && req.method === 'POST') {
+        res.statusCode = 200
+        res.end()
+      } else if (req.url === '/localapi/v0/login-interactive') {
+        res.statusCode = 204
+        res.end()
+      } else {
+        res.statusCode = 404
+        res.end('nope')
+      }
+    })
+  }, async (socketPath) => {
+    const api = new LocalAPI({ socketPath })
+    const status = await api.status()
+    assert.equal(status.BackendState, 'Running')
+    const { etag } = await api.serveConfig()
+    assert.equal(etag, 'abc')
+    await api.setServeConfig({ TCP: {} }, etag)
+    await api.loginInteractive()
+    await assert.rejects(() => api.expect('GET', '/missing'), /404/)
+  })
+  const post = seen.find((s) => s.method === 'POST' && s.url === '/localapi/v0/serve-config')
+  assert.equal(post.sec, 'localapi')
+  assert.equal(post.ifMatch, 'abc')
+  assert.equal(post.body, JSON.stringify({ TCP: {} }))
+})
+
+function fakeKernel(tmp, { installed = true } = {}) {
+  return {
+    platform: 'darwin',
+    homedir: tmp,
+    server_port: 42000,
+    path: (...segments) => path.join(tmp, ...segments),
+    processes: {},
+    memory: { local: {} },
+    bin: {
+      path: (...segments) => path.join(tmp, 'bin', ...segments),
+      mod: { tailscaled: { installed: async () => installed, binPath: () => path.join(tmp, 'bin', 'tailscaled') } },
+    },
+  }
+}
+
+test('anywhere snapshot walks setup -> off -> login -> https -> ready', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
+  try {
+    const kernel = fakeKernel(tmp, { installed: false })
+    const anywhere = new Anywhere(kernel)
+    assert.equal((await anywhere.snapshot()).phase, 'setup')
+
+    kernel.bin.mod.tailscaled.installed = async () => true
+    assert.equal((await anywhere.snapshot()).phase, 'off')
+
+    await anywhere.saveConfig({ enabled: true })
+    assert.equal(await anywhere.configured(), true)
+    assert.equal(JSON.parse(fs.readFileSync(path.join(tmp, 'anywhere', 'config.json'), 'utf8')).enabled, true)
+
+    // stub the daemon
+    let status = { BackendState: 'NeedsLogin', AuthURL: 'https://login.tailscale.com/a/abc', Self: {}, Peer: null, User: null }
+    let loginRequests = 0
+    let pushed = null
+    anywhere.pid = 123
+    anywhere.api = {
+      status: async () => status,
+      loginInteractive: async () => { loginRequests += 1 },
+      queryFeature: async () => ({ Complete: false, Text: 'approve', URL: 'https://login.tailscale.com/f/serve?node=1' }),
+      serveConfig: async () => ({ config: null, etag: 'e1' }),
+      setServeConfig: async (config) => { pushed = config },
+    }
+    let snap = await anywhere.snapshot()
+    assert.equal(snap.phase, 'login')
+    assert.equal(snap.loginUrl, 'https://login.tailscale.com/a/abc')
+    assert.equal(loginRequests, 0, 'uses the AuthURL the daemon already has')
+
+    anywhere.lastStatusAt = 0
+    status = { BackendState: 'NeedsLogin', AuthURL: '', Self: {}, Peer: null, User: null }
+    snap = await anywhere.snapshot()
+    assert.equal(loginRequests, 1, 'asks the daemon for a login URL when it has none')
+
+    anywhere.lastStatusAt = 0
+    status = {
+      BackendState: 'Running',
+      Version: '1.104.1',
+      TailscaleIPs: ['100.1.2.3'],
+      CertDomains: null,
+      Self: { DNSName: 'pinokio.tail1.ts.net.', UserID: 7, KeyExpiry: '2027-04-20T04:33:03Z' },
+      User: { '7': { LoginName: 'me@example.com', DisplayName: 'Me' } },
+      Peer: { a: { HostName: 'iphone', OS: 'iOS', Online: true, DNSName: 'iphone.tail1.ts.net.', TailscaleIPs: ['100.1.2.4'], LastSeen: '0001-01-01T00:00:00Z' } },
+      CurrentTailnet: { Name: 'me@example.com', MagicDNSSuffix: 'tail1.ts.net', MagicDNSEnabled: true },
+    }
+    snap = await anywhere.snapshot()
+    assert.equal(snap.phase, 'https')
+    assert.equal(snap.approval.url, 'https://login.tailscale.com/f/serve?node=1')
+    assert.equal(snap.address, 'https://pinokio.tail1.ts.net')
+
+    anywhere.lastStatusAt = 0
+    anywhere.featureAt = 0
+    status.CertDomains = ['pinokio.tail1.ts.net']
+    kernel.memory.local = { [path.join(tmp, 'api', 'comfy', 'start.json')]: { url: 'http://localhost:7860', other: 'not a url' } }
+    snap = await anywhere.snapshot()
+    assert.equal(snap.phase, 'ready')
+    assert.equal(snap.account.email, 'me@example.com')
+    assert.equal(snap.keyExpiry, '2027-04-20T04:33:03Z')
+    assert.equal(snap.mobilePeerPresent, true)
+    assert.equal(snap.mobilePeerOnline, true)
+    assert.equal(snap.connectUrl, 'https://pinokio.co/anywhere/connect#u=https%3A%2F%2Fpinokio.tail1.ts.net&a=me%40example.com')
+    assert.deepEqual(snap.serve.map((s) => [s.url, s.local, s.name]), [['https://pinokio.tail1.ts.net', 42000, null], ['https://pinokio.tail1.ts.net:43000', 7860, 'comfy']])
+    assert.deepEqual(JSON.parse(fs.readFileSync(path.join(tmp, 'anywhere', 'ports.json'), 'utf8')), { comfy: 43000 }, 'stable port persisted')
+
+    // menu links are rewritten only for requests addressed to the node itself
+    const menu = () => [
+      { href: 'http://localhost:7860/?x=1#t', src: 'http://localhost:7860/?x=1#t', target_full: 'http://localhost:7860/?x=1#t', menu: [{ href: 'http://127.0.0.1:42000/home' }] },
+      { href: 'http://localhost:9999/' },
+      { href: '/files/api/comfy' },
+      { href: 'https://example.com:7860/' },
+    ]
+    for (const host of ['localhost:42000', '192.168.1.5:42000', 'pinokio.p5.localhost', undefined]) {
+      assert.deepEqual(await anywhere.rewriteMenu(host, menu()), menu(), `untouched for host ${host}`)
+    }
+    for (const host of ['pinokio.tail1.ts.net', 'PINOKIO.TAIL1.TS.NET:443']) {
+      const rewritten = await anywhere.rewriteMenu(host, menu())
+      assert.equal(rewritten[0].href, 'https://pinokio.tail1.ts.net:43000/?x=1#t')
+      assert.equal(rewritten[0].src, 'https://pinokio.tail1.ts.net:43000/?x=1#t')
+      assert.equal(rewritten[0].target_full, 'https://pinokio.tail1.ts.net:43000/?x=1#t', 'the popout target follows the href')
+      assert.equal(rewritten[0].menu[0].href, 'https://pinokio.tail1.ts.net/home', 'pinokiod itself maps to the bare address')
+      assert.equal(rewritten[1].href, 'http://localhost:9999/', 'unpublished ports are left alone')
+      assert.equal(rewritten[2].href, '/files/api/comfy')
+      assert.equal(rewritten[3].href, 'https://example.com:7860/')
+    }
+    // sync pushes once, then only on changes
+    assert.equal(await anywhere.sync(), true)
+    assert.deepEqual(Object.keys(pushed.TCP), ['443', '43000'])
+    pushed = null
+    assert.equal(await anywhere.sync(), false)
+    assert.equal(pushed, null)
+
+    // an app that just published its URL gets its stable port at render time
+    // and its route is pushed right away, without waiting for the next sync tick
+    kernel.memory.local[path.join(tmp, 'api', 'forge', 'start.json')] = { url: 'http://127.0.0.1:8188' }
+    const fresh = await anywhere.rewriteMenu('pinokio.tail1.ts.net', [{ href: 'http://127.0.0.1:8188/' }])
+    assert.equal(fresh[0].href, 'https://pinokio.tail1.ts.net:43001/')
+    assert.deepEqual(JSON.parse(fs.readFileSync(path.join(tmp, 'anywhere', 'ports.json'), 'utf8')), { comfy: 43000, forge: 43001 })
+    await anywhere.syncing
+    assert.deepEqual(Object.keys(pushed.TCP), ['443', '43000', '43001'], 'route pushed at render time')
+    pushed = null
+    assert.equal(await anywhere.sync(), false)
+    kernel.memory.local = {}
+    assert.equal(await anywhere.sync(), true, 'stopped app removes its entry')
+    assert.deepEqual(Object.keys(pushed.TCP), ['443'])
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})
+
+test('anywhere uses dev mode flags on windows and a short socket path on long homes', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
+  try {
+    const kernel = fakeKernel(tmp)
+    kernel.platform = 'win32'
+    const win = new Anywhere(kernel)
+    assert.ok(win.daemonArgs().includes('--windows-mode=dev'))
+    assert.ok(win.daemonArgs().includes('--tun=userspace-networking'))
+    assert.equal(win.socketPath(), '\\\\.\\pipe\\pinokio-tailscaled')
+
+    const longHome = path.join(tmp, 'x'.repeat(120))
+    const deep = new Anywhere(fakeKernel(longHome))
+    assert.ok(Buffer.byteLength(deep.socketPath()) <= 100, deep.socketPath())
+    assert.ok(deep.socketPath().startsWith(os.tmpdir()))
+    const shallow = new Anywhere(fakeKernel('/Users/me/pinokio'))
+    assert.equal(shallow.socketPath(), '/Users/me/pinokio/anywhere/tailscaled/tailscaled.sock')
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})
+
+test('while Anywhere is off, sync and the menu rewrite are no-ops and never touch the daemon', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
+  try {
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    anywhere.api = new Proxy({}, { get() { throw new Error('LocalAPI must not be called while Anywhere is off') } })
+    assert.equal(await anywhere.sync(), false)
+    await anywhere.loadConfig()
+    assert.equal(await anywhere.sync(), false)
+    const menu = [{ href: 'http://localhost:7860/' }, { href: 'http://127.0.0.1:42000/home' }]
+    assert.deepEqual(await anywhere.rewriteMenu('pinokio.tail1.ts.net', JSON.parse(JSON.stringify(menu))), menu)
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})
+
+test('serve targets follow the Home Server router rules for an app\'s URL variables', () => {
+  const tmp = path.join(os.tmpdir(), 'pk-home')
+  const kernel = fakeKernel(tmp)
+  kernel.router = {
+    localhost_variable_router: {
+      domain(name, key) {
+        if (name === 'comfy') return key === 'url' ? '@' : (key === 'api_url' ? 'api' : undefined)
+        throw new Error('no pinokio config for ' + name)   // what Processor.domain does for an unknown app
+      },
+    },
+  }
+  kernel.memory.local = {
+    [path.join(tmp, 'api', 'comfy', 'start.json')]: {
+      url: 'http://localhost:7860',
+      api_url: 'http://127.0.0.1:7861',
+      other: 'http://localhost:7862',         // not dns-mapped
+      remote: 'http://192.168.1.9:7863',      // not loopback: cannot be proxied
+      noport: 'http://localhost',
+      count: 3,
+    },
+    [path.join(tmp, 'api', 'nocfg', 'start.json')]: { url: 'http://localhost:8000', other: 'http://localhost:8001' },
+    ['/elsewhere/start.json']: { url: 'http://localhost:9000' },   // outside ~/pinokio/api
+  }
+  const anywhere = new Anywhere(kernel)
+  assert.deepEqual(anywhere.appTargets(), [   // `url` first, then the other keys alphabetically
+    { key: 'comfy', name: 'comfy', local: 7860 },
+    { key: 'api.comfy', name: 'comfy', local: 7861 },
+    { key: 'nocfg', name: 'nocfg', local: 8000 },
+  ])
+})
+
+test('a failed https feature query keeps the page in starting instead of showing an approval', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
+  try {
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    await anywhere.saveConfig({ enabled: true })
+    anywhere.pid = 123
+    let feature = () => { throw new Error('503 no netmap') }
+    anywhere.api = {
+      status: async () => ({ BackendState: 'Running', CertDomains: null, Self: { DNSName: 'pinokio.tail1.ts.net.', UserID: 7 }, User: {}, Peer: null }),
+      queryFeature: async () => feature(),
+    }
+    let snap = await anywhere.snapshot()
+    assert.equal(snap.phase, 'starting')
+    assert.equal(snap.approval, null)
+    feature = () => ({ Complete: false, Text: 'approve', URL: 'https://login.tailscale.com/f/serve?node=1' })
+    anywhere.lastStatusAt = 0
+    snap = await anywhere.snapshot()
+    assert.equal(snap.phase, 'https')
+    assert.equal(snap.approval.url, 'https://login.tailscale.com/f/serve?node=1')
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})
+
+// a stand-in daemon process we can safely signal
+function spawnIdle() {
+  const child = spawn(process.execPath, ['-e', 'setTimeout(() => {}, 30000)'], { stdio: 'ignore' })   // self-exits if a run is cut short
+  const exited = new Promise((resolve) => child.on('exit', () => resolve(true)))
+  return { child, exited: (ms = 3000) => Promise.race([exited, new Promise((resolve) => setTimeout(() => resolve(false), ms))]) }
+}
+
+test('adopting a daemon left by a previous run recovers its pid from the pid file', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
+  const idle = spawnIdle()
+  try {
+    const kernel = fakeKernel(tmp)
+    const anywhere = new Anywhere(kernel)
+    fs.mkdirSync(anywhere.stateDir(), { recursive: true })
+    const dead = spawnIdle(); dead.child.kill('SIGKILL'); await dead.exited()
+    fs.writeFileSync(anywhere.pidPath(), String(dead.child.pid))
+    assert.equal(anywhere.readPid(), null, 'a pid that no longer exists is ignored')
+    fs.writeFileSync(anywhere.pidPath(), String(idle.child.pid))
+    await anywhere.saveConfig({ enabled: true })
+    anywhere.api = {
+      ping: async () => true,
+      patchPrefs: async () => ({}),
+      status: async () => ({ BackendState: 'NeedsLogin', AuthURL: 'https://login.tailscale.com/a/abc', Self: {}, User: null, Peer: null }),
+    }
+    await anywhere.start()
+    assert.equal(anywhere.pid, idle.child.pid)
+  } finally {
+    idle.child.kill('SIGKILL')
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})
+
+
+test('a daemon that cannot be spawned reports the cause at once instead of waiting 20 s', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
+  try {
+    const kernel = fakeKernel(tmp)
+    kernel.bin.mod.tailscaled.binPath = () => path.join(tmp, 'no-such-tailscaled')
+    const anywhere = new Anywhere(kernel)
+    await anywhere.saveConfig({ enabled: true })
+    const started = Date.now()
+    await assert.rejects(() => anywhere.start(), /failed to start/)
+    assert.ok(Date.now() - started < 5000, 'did not sit out the 20 s daemon timeout')
+    assert.equal((await anywhere.snapshot()).phase, 'error')
+    assert.equal(fs.existsSync(anywhere.pidPath()), false)
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})
+
+test('sign-out resets the login state, and a link the server rejected is replaced instead of shown', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
+  try {
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    await anywhere.saveConfig({ enabled: true })
+    anywhere.pid = 123
+    const calls = []
+    let status = { BackendState: 'NeedsLogin', AuthURL: 'https://login.tailscale.com/a/dead', Self: {}, User: null, Peer: null,
+      Health: ['You are logged out. The last login error was: register request: http 410: auth path not found'] }
+    anywhere.api = {
+      status: async () => status,
+      logout: async () => { calls.push('logout') },
+      patchPrefs: async (p) => { calls.push('prefs:' + (p.LoggedOut === false ? 'login' : 'other')); return {} },
+      start: async () => { calls.push('start') },
+      loginInteractive: async () => { calls.push('login-interactive') },
+    }
+    await anywhere.logout()
+    assert.deepEqual(calls, ['logout', 'prefs:login', 'start'], 'sign-out: logout, then back to logged-in prefs, then reset')
+
+    calls.length = 0
+    let snap = await anywhere.snapshot()
+    assert.equal(snap.loginUrl, null, 'the rejected link is not offered')
+    assert.equal(snap.phase, 'starting')
+    assert.deepEqual(calls, ['start', 'login-interactive'], 'a rejected link triggers a reset and a fresh request')
+
+    // after the reset the daemon keeps a stale "last login error: ... context canceled" line; that is not a rejection
+    anywhere.lastStatusAt = 0
+    calls.length = 0
+    status = { BackendState: 'NeedsLogin', AuthURL: 'https://login.tailscale.com/a/fresh', Self: {}, User: null, Peer: null,
+      Health: ['You are logged out. The last login error was: fetch control key: Get "https://controlplane.tailscale.com/key?v=148": context canceled'] }
+    snap = await anywhere.snapshot()
+    assert.equal(snap.loginUrl, 'https://login.tailscale.com/a/fresh', 'a fresh link is offered as is')
+    assert.equal(snap.phase, 'login')
+    assert.deepEqual(calls, [], 'no reset loop on a stale error line')
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+})
+
+
+test('old Tailscale daemons are stopped and cannot be adopted through direct start', async t => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-version-'))
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }))
+  const anywhere = new Anywhere(fakeKernel(root, { installed: false }))
+  let stopped = 0
+  anywhere.daemonAlive = async () => true
+  anywhere.enabled = async () => true
+  anywhere.stop = async () => { stopped++ }
+  assert.equal(await anywhere.autostart(), false)
+  assert.equal(stopped, 1)
+  await assert.rejects(anywhere.start(), /Update the tailscaled tool/)
+  assert.equal(stopped, 2)
+})

package/test/conda-bin.test.js

@@ -6,16 +6,40 @@ const os = require('node:os')
 const path = require('node:path')
 const test = require('node:test')
 
-const Bin = require('../kernel/bin')
-const Conda = require('../kernel/bin/conda')
+let Bin
+let Conda
 const {
   CONDA_PIN_VERSION,
   PYTHON_INSTALL_SPEC,
   WINDOWS_PYTHON_SSL_FIX_SPEC,
   isExpectedCondaPinned,
   isExpectedPythonPinned,
+  TLS_PACKAGE_MINIMUMS,
+  TLS_PACKAGE_SPECS,
+  PIP_INSTALL_SPEC,
+  PIP_MIN_VERSION,
 } = require('../kernel/bin/conda-pins')
 
+test.beforeEach(t => {
+  const realExecFile = childProcess.execFile.bind(childProcess)
+  t.mock.method(childProcess, 'execFile', (binary, args, options, done) => {
+    if (args[0] !== '-I' || args[1] !== '-c') return realExecFile(binary, args, options, done)
+    const prefix = path.basename(binary) === 'python.exe' ? path.dirname(binary) : path.dirname(path.dirname(binary))
+    if (args[2].includes('certifi.where()')) {
+      done(null, path.join(prefix, 'certificates.pem') + '\n2026.10.19\n')
+      return
+    }
+    fs.readFile(path.join(prefix, 'test-pip-version'), 'utf8').then(
+      version => done(null, version), error => done(error, '')
+    )
+  })
+  for (const file of ['../kernel/bin/conda-meta', '../kernel/bin/conda', '../kernel/bin']) {
+    delete require.cache[require.resolve(file)]
+  }
+  Bin = require('../kernel/bin')
+  Conda = require('../kernel/bin/conda')
+})
+
 async function pathExists(target) {
   return fs.access(target).then(() => true).catch(() => false)
 }
@@ -49,6 +73,10 @@ async function writeHealthyCondaMeta(root, platform = 'win32', condaVersion = CO
   await writeCondaMeta(root, 'conda', condaVersion, 'py310')
   await writeCondaMeta(root, 'conda-libmamba-solver', '25.4.0', 'pyhd3eb1b0_0')
   await writeCondaMeta(root, 'python', '3.10.20', platform === 'win32' ? 'h4de0772_1_cpython' : 'cpython')
+  for (const [name, version] of Object.entries(TLS_PACKAGE_MINIMUMS)) {
+    await writeCondaMeta(root, name, version)
+  }
+  await fs.writeFile(path.join(root, 'bin/miniforge/test-pip-version'), PIP_MIN_VERSION)
 }
 
 async function writeFakeManagedConda(root, platform = 'win32') {
@@ -87,6 +115,7 @@ function restoreEnv(name, value) {
 function createConda(kernel) {
   const conda = new Conda()
   conda.kernel = kernel
+  conda.verifyInstaller = async () => {} // Installer lifecycle tests mock the download.
   return conda
 }
 
@@ -161,7 +190,7 @@ test('Conda uses Miniforge assets and writes conda-forge-only config', async ()
 
   assert.equal(
     conda.urls.win32.x64,
-    'https://github.com/conda-forge/miniforge/releases/download/26.3.2-3/Miniforge3-Windows-x86_64.exe'
+    'https://github.com/conda-forge/miniforge/releases/download/26.9.4-0/Miniforge3-Windows-x86_64.exe'
   )
 
   await conda.init()
@@ -201,7 +230,7 @@ test('Conda init writes the current Conda pin into an existing runtime', async (
 
   assert.equal(
     await fs.readFile(path.join(root, 'bin', 'miniforge', 'conda-meta', 'pinned'), 'utf8'),
-    'conda ==26.5.3'
+    ['conda ==26.5.3', ...TLS_PACKAGE_SPECS].join('\n')
   )
 })
 
@@ -253,13 +282,14 @@ test('Conda install requests the Python 3.10.20 pin on macOS/Linux', async () =>
   assert.equal(await pathExists(path.join(root, 'bin', 'miniconda')), true)
   const condaInstall = calls.find((call) => Array.isArray(call.message))
   assert.ok(condaInstall)
+  assert.equal(condaInstall.message[2], `python -I -m pip --isolated --disable-pip-version-check install --no-index --no-deps "${PIP_INSTALL_SPEC}"`)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0"'
+    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" pip "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
   )
   assert.equal(
     await fs.readFile(path.join(root, 'bin', 'miniforge', 'conda-meta', 'pinned'), 'utf8'),
-    'conda ==26.5.3'
+    ['conda ==26.5.3', ...TLS_PACKAGE_SPECS].join('\n')
   )
 })
 
@@ -287,7 +317,7 @@ test('Conda install keeps the Windows Python 3.10.20 SSL-fixed build pin', async
   assert.ok(condaInstall)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20=*_1_cpython" "conda-libmamba-solver>=25.4.0"'
+    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20=*_1_cpython" "conda-libmamba-solver>=25.4.0" pip "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
   )
 })
 
@@ -319,7 +349,7 @@ test('Conda install replaces the stale runtime and rebuilds declared Conda modul
   assert.ok(condaInstall)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" uv=0.11.23 nodejs=22.21.1 pnpm'
+    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" pip "ca-certificates>=2026.10.19" "certifi>=2026.10.19" uv=0.11.23 nodejs=22.21.1 pnpm'
   )
 })
 
@@ -583,3 +613,91 @@ test('Conda install reports recovery details when the old runtime cannot be remo
     fsModule.promises.rm = originalRm
   }
 })
+
+
+test('stale certificate packages trigger the existing Conda setup checks', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-certs-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  await writeHealthyCondaMeta(root, 'darwin')
+  await writeFakeManagedConda(root, 'darwin')
+  for (const [name, version] of Object.entries(TLS_PACKAGE_MINIMUMS)) {
+    await fs.rm(path.join(root, 'bin/miniforge/conda-meta', `${name}-${version}.json`))
+    await writeCondaMeta(root, name, '2026.4.22')
+  }
+  assert.equal(await createConda(createKernel(root, 'darwin')).check(), false)
+  const bin = createBin(root, 'darwin')
+  await bin.tryList()
+  assert.equal(bin.correct_conda, false)
+})
+
+test('tampered Miniforge installers leave the existing runtime untouched', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-hash-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  await createMiniforge(root)
+  const kernel = createKernel(root, 'darwin')
+  kernel.bin.download = async () => fs.writeFile(path.join(root, 'bin/installer.sh'), 'tampered')
+  const conda = new Conda()
+  conda.kernel = kernel
+  await assert.rejects(conda._install({}, () => {}), /SHA-256 verification failed/)
+  assert.equal(await pathExists(path.join(root, 'bin/miniforge/Scripts/conda.exe')), true)
+})
+
+
+test('old pip cannot pass Conda readiness even with current CA packages', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-pip-ready-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  await writeHealthyCondaMeta(root, 'darwin')
+  await writeFakeManagedConda(root, 'darwin')
+  await fs.writeFile(path.join(root, 'bin/miniforge/test-pip-version'), '26.2.1')
+  assert.equal(await createConda(createKernel(root, 'darwin')).check(), false)
+  const bin = createBin(root, 'darwin')
+  await bin.tryList()
+  assert.equal(bin.correct_conda, false)
+})
+
+test('certificate refresh preserves named environments and uses the new CA bundle', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-ca-refresh-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  await writeHealthyCondaMeta(root, 'darwin')
+  await writeFakeManagedConda(root, 'darwin')
+  const marker = path.join(root, 'bin/miniforge/envs/app/keep')
+  await fs.mkdir(path.dirname(marker), { recursive: true })
+  await fs.writeFile(marker, 'existing app')
+  const kernel = createKernel(root, 'darwin')
+  const calls = []
+  kernel.bin.download = async () => assert.fail('must not replace a working runtime')
+  kernel.bin.exec = async payload => { calls.push(payload); return {} }
+  await createConda(kernel).install({}, () => {})
+  assert.equal(await fs.readFile(marker, 'utf8'), 'existing app')
+  assert.equal(calls.length, 2)
+  assert.equal(calls[1].env.CONDA_SSL_VERIFY, path.join(root, 'bin/miniforge/certificates.pem'))
+})
+
+test('failed pip bootstrap stops certificate refresh without replacing environments', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-ca-failed-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  await writeHealthyCondaMeta(root, 'darwin')
+  await writeFakeManagedConda(root, 'darwin')
+  const kernel = createKernel(root, 'darwin')
+  kernel.bin.exec = async () => ({ error: ['ERROR: hash verification failed'] })
+  kernel.bin.download = async () => assert.fail('must preserve the runtime')
+  await assert.rejects(createConda(kernel).install({}, () => {}), /bootstrap failed/)
+  assert.equal(await pathExists(path.join(root, 'bin/miniforge/conda-meta')), true)
+})
+
+test('fresh installation does not report a failed pip bootstrap as finished', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-install-failed-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  await fs.mkdir(path.join(root, 'bin'), { recursive: true })
+  const kernel = createKernel(root, 'darwin')
+  kernel.bin.mods = []
+  kernel.bin.download = async () => {}
+  kernel.bin.exec = async payload => {
+    if (payload.conda?.skip) {
+      await fs.mkdir(path.join(root, 'bin/miniforge/conda-meta'), { recursive: true })
+      return {}
+    }
+    return { error: ['ERROR: pip download failed'] }
+  }
+  await assert.rejects(createConda(kernel)._install({}, () => {}), /pip installation failed/)
+})