pinokiod 8.2.20 → 8.2.22

package/docs/SECURITY_TODO.md

@@ -0,0 +1,126 @@
+# Security TODO (deferred)
+
+Written 2026-10-28. These are security items deliberately left out of the
+current work, kept here so they can be revisited later.
+
+The common thread: Pinokio owns the environment, the process spawn, the
+network path, the secrets and the whole fleet of installed apps. Each item
+below is a control that only a launcher can apply to every app at once.
+
+---
+
+## A. Foundation (fix before making any "safe" claim)
+
+### A1. Origin check on the WebSocket
+- Where: `server/socket.js` (`new WebSocket.Server({ server })`, no `verifyClient`;
+  `ws._origin` is recorded but never enforced).
+- Problem: any page that can open a WebSocket to the daemon can send
+  `{method:"shell.run"}`. HTTPS pages are stopped by mixed-content rules, and
+  Chrome 154 warns before public HTTP pages, but Pinokio's own app UIs run on
+  `http://localhost:<port>` and are exempt from both. An XSS bug in a Gradio
+  app or ComfyUI custom node becomes a shell command on the machine. With the
+  HTTPS/Caddy router on, `wss://pinokio.localhost` is reachable from HTTPS
+  pages too.
+- Fix: accept only Pinokio's own origins (the daemon UI, `*.localhost` router
+  hosts, the Anywhere Tailscale host), plus a per-session token for the UI.
+
+### A2. Network exposure of the daemon
+- Where: `server/index.js` (`server.listen(port)` with no host, so all
+  interfaces; `cors({origin:'*'})`; `express-session` secret is the literal
+  string `"secret"`; no auth middleware).
+- Fix: bind 127.0.0.1 unless LAN sharing or Anywhere is enabled; random
+  session secret.
+
+### A3. Static file routes serve the whole Pinokio home
+- Where: `server/index.js` mounts `express.static(kernel.homedir)` at `/asset`
+  and `/files` with `serveIndex(hidden: true)`.
+- Problem: `key.json`, every `ENVIRONMENT` file and `connect/*/auth.json` are
+  downloadable by anything that can reach the daemon.
+- Fix: deny-list secret files/dirs, or move secrets out of the home tree.
+
+### A4. Secrets hygiene
+- `kernel/key.js` `set()` logs `{ key, val, password }` to the console.
+- Secrets live in plaintext: `~/pinokio/ENVIRONMENT`, per-app `ENVIRONMENT`,
+  `key.json`, `cache/HF_AUTH/token`, `connect/<provider>/auth.json`.
+- A new app's ENVIRONMENT inherits every custom key from the system
+  ENVIRONMENT (`kernel/environment.js`, `ENV("app")`), so user secrets
+  propagate into every app.
+- Fix: stop the logging; OS keychain for storage; stop inheriting secrets into
+  app ENVIRONMENT by default.
+
+### A5. Unverified downloads and unpinned system clones
+- `Bin.download` (`kernel/bin/index.js`) does no hash check. Direct URL
+  downloads with no hash: cloudflared (`releases/latest`), Homebrew zip and VS
+  Build Tools from `cocktailpeanut/bin`, aria2, cmake, mingw, standalone
+  python. Only Miniforge and the pip seed wheel are SHA-256 verified.
+- `pinokiocomputer/proto`, `network`, `proxy_registry`, `python` are cloned
+  from GitHub HEAD, unpinned, and re-cloned on every version change.
+- Fix: hash table per download (as done for Miniforge); pin system repos to a
+  commit or tag.
+
+### A6. PyTorch safe unpickling is disabled globally
+- Where: `kernel/shell.js` sets `TORCH_FORCE_NO_WEIGHTS_ONLY_LOAD=1` for every
+  app shell.
+- Problem: turns off the `weights_only=True` default PyTorch has shipped since
+  2.6. Malicious pickle models (nullifAI, Feb 2025) are a known vector.
+- Fix: make it per-app opt-in with a visible warning badge instead of global.
+
+---
+
+## B. Platform security features (the "install through Pinokio and you're safe" story)
+
+### B1. Security advisory feed + Security Center
+- A small signed JSON list of blocked package versions, maintained by Pinokio,
+  fetched periodically (the OneCRL idea, applied to AI apps).
+- Enforce through env Pinokio already controls in `Shell.init_env`:
+  `PIP_CONSTRAINT` and `UV_CONSTRAINT` (constraints file with
+  `pkg!=x.y.z` lines), `UV_EXCLUDE_NEWER`, and bluefairy shims for npm/bun.
+- Example it would have stopped: Ultralytics 8.3.41/42/45/46 (Dec 2024
+  cryptominer), which reached ComfyUI users via the Impact Pack.
+- Security Center page: audit every app env (pip version, certifi, blocked
+  packages), one-click repair, fleet-wide. No app can do this for other apps.
+
+### B2. Release-age cooldown on by default
+- bluefairy exists (`kernel/bin/bluefairy.js`) but `protection_enabled`
+  defaults to `false` (`server/lib/app_preferences.js`), only applies to
+  `shell.run` (forced `"off"` for `shell.start`, `kernel.exec`, `bin.exec`),
+  and shims only npm/bun/uv, not pip or conda.
+- pnpm 11 and Yarn 4.10 now ship a cooldown on by default. Turn it on
+  globally (24h-72h), extend to pip, let the advisory feed override.
+
+### B3. Credential brokering (apps never see real secrets)
+- Run a local credential-injecting proxy and point apps at it via
+  `HF_ENDPOINT`, `OPENAI_BASE_URL`, `ANTHROPIC_BASE_URL`, etc. The app gets a
+  per-app placeholder; Pinokio adds the real token on the way out.
+- Gives per-app usage visibility and instant revocation. A malicious custom
+  node has nothing to exfiltrate.
+- Simpler interim: issue fine-grained per-app HF tokens.
+
+### B4. Model file scanning
+- `kernel/vault/*` (Disk Saver) already walks and hashes every model file.
+  Add a picklescan/modelscan pass for `.ckpt`, `.pt`, `.pth`, `.bin` and
+  surface results per app. Pairs with A6.
+
+### B5. Per-app sandbox (phased)
+- Chokepoint: every app command goes through `pty.spawn` in `kernel/shell.js`
+  (`Shell.init_env` → `exec`). The `exec` API (`kernel/api/exec`) and `sudo`
+  path (`shell.js` ~610) bypass it and need the same wrapper.
+- Reference implementation: Anthropic sandbox-runtime (sandbox-exec on macOS,
+  bubblewrap on Linux, local proxy for a domain allowlist; Windows in
+  progress).
+- Phase 1, observe only: show which domains an app contacted and what it
+  wrote outside its folder. Breaks nothing, already a visible value-add.
+- Phase 2: enforce per-app network allowlists (huggingface.co, pypi.org,
+  github.com by default).
+- Phase 3: filesystem confinement to app folder + shared caches.
+- Windows is the hard platform; ship macOS/Linux first.
+
+### B6. Script execution boundary (longer term)
+- `kernel/loader.js` `requireJS()` loads every `pinokio.js` / `install.js` /
+  `start.js` with plain `require()` in the daemon process, and `pinokio.js`
+  runs when an app is merely listed (`api.meta`, menu rendering).
+- `Api.resolveMethod` (`kernel/api/index.js`) dispatches `kernel.*` methods,
+  `exec`, `fs.download`, `script.start` and `sudo` to scripts with the live
+  kernel object.
+- Options: isolate scripts (vm / worker), capability gate at `resolveMethod`,
+  stop executing `pinokio.js` on listing.

package/kernel/bin/conda.js

@@ -273,6 +273,11 @@ report_errors: false`)
       await caddy.stop()
     }
 
+    if (this.kernel.anywhere) {
+      ondata({ raw: `stopping Pinokio Anywhere before replacing Miniforge...\r\n` })
+      await this.kernel.anywhere.stop()
+    }
+
     legacy_path_exists = await this.kernel.exists(`bin/${LEGACY_CONDA_ROOT_DIR}`)
     if (legacy_path_exists) {
       console.log("Removing legacy install path...", legacy_path)

package/kernel/cert_env.js

@@ -0,0 +1,132 @@
+const fs = require('fs')
+const path = require('path')
+const { randomUUID } = require('crypto')
+
+// The managed CA bundle: the conda-forge ca-certificates package inside Miniforge.
+// Every app's Python HTTPS traffic is pointed at this one file so a revoked root is
+// retired for all apps, old or new, by updating this file alone.
+function managedCertPaths(homedir, platform = process.platform) {
+  const dir = platform === 'win32'
+    ? path.resolve(homedir, 'bin', 'miniforge', 'Library', 'ssl')
+    : path.resolve(homedir, 'bin', 'miniforge', 'ssl')
+  return { dir, file: path.resolve(dir, 'cacert.pem') }
+}
+
+function findEnvKey(env, key) {
+  const wanted = key.toLowerCase()
+  return Object.keys(env).find(envKey => envKey.toLowerCase() === wanted)
+}
+
+function hasEnvValue(env, key) {
+  const envKey = findEnvKey(env, key)
+  return !!envKey && typeof env[envKey] === 'string' && env[envKey].trim().length > 0
+}
+
+function setEnvValue(env, key, value) {
+  env[findEnvKey(env, key) || key] = value
+}
+
+// Defaults for the three readers that otherwise fall back to a private certifi copy:
+// httpx and Python's ssl module (SSL_CERT_FILE), requests (REQUESTS_CA_BUNDLE) and pip (PIP_CERT).
+// A default is applied only when none of its related variables is set, because the readers
+// rank them: httpx prefers SSL_CERT_FILE over SSL_CERT_DIR and requests prefers
+// REQUESTS_CA_BUNDLE over CURL_CA_BUNDLE, so defaulting one would silently override a
+// custom setting of the other.
+function applyManagedCertEnv(env, { file, dir, platform = process.platform }) {
+  if (!hasEnvValue(env, 'SSL_CERT_FILE') && !hasEnvValue(env, 'SSL_CERT_DIR')) {
+    setEnvValue(env, 'SSL_CERT_FILE', file)
+    if (platform === 'win32') {
+      // conda-forge OpenSSL on Windows points SSL_CERT_DIR at an empty directory, which uv treats
+      // as an explicit (empty) certificate source. Give it the directory that holds the bundle.
+      setEnvValue(env, 'SSL_CERT_DIR', dir)
+    }
+  }
+  if (!hasEnvValue(env, 'REQUESTS_CA_BUNDLE') && !hasEnvValue(env, 'CURL_CA_BUNDLE')) {
+    setEnvValue(env, 'REQUESTS_CA_BUNDLE', file)
+  }
+  if (!hasEnvValue(env, 'PIP_CERT')) {
+    setEnvValue(env, 'PIP_CERT', file)
+  }
+  return env
+}
+
+// pip carries its own certifi copy and, from 24.2 on, loads it no matter what the environment
+// says. The only way to retire a root from an existing environment's pip is to replace that file.
+async function pipVendoredBundles(prefix, platform = process.platform) {
+  const sitePackages = []
+  if (platform === 'win32') {
+    sitePackages.push(path.join(prefix, 'Lib', 'site-packages'))
+  } else {
+    const lib = path.join(prefix, 'lib')
+    const entries = await fs.promises.readdir(lib).catch(() => [])
+    for (const entry of entries) {
+      if (/^python\d/.test(entry)) sitePackages.push(path.join(lib, entry, 'site-packages'))
+    }
+  }
+  return sitePackages.map(dir => path.join(dir, 'pip', '_vendor', 'certifi', 'cacert.pem'))
+}
+
+const bundleCache = new Map()
+async function readManagedBundle(file) {
+  const stat = await fs.promises.stat(file)
+  const cached = bundleCache.get(file)
+  if (cached && cached.mtimeMs === stat.mtimeMs && cached.size === stat.size) return cached.data
+  const data = await fs.promises.readFile(file)
+  bundleCache.set(file, { mtimeMs: stat.mtimeMs, size: stat.size, data })
+  return data
+}
+
+// Replaces pip's vendored cacert.pem under `prefix` with the managed bundle when they differ.
+// The file is published with write-to-temp + rename, never edited in place: in conda
+// environments pip's files are hardlinked from the package cache, and editing in place would
+// change the cached copy too. Returns the paths that were replaced.
+async function repairPipVendoredBundle(prefix, bundleFile, platform = process.platform) {
+  const managed = await readManagedBundle(bundleFile).catch(() => null)
+  if (!managed) return []
+  const repaired = []
+  for (const target of await pipVendoredBundles(prefix, platform)) {
+    const stat = await fs.promises.stat(target).catch(() => null)
+    if (stat && !stat.isFile()) continue
+    if (!stat) {
+      // No pip here: nothing to do. pip present but its bundle gone (the user deleted a file
+      // Pinokio could not replace): write a fresh one, or pip fails on every network call.
+      const certifiDir = await fs.promises.stat(path.dirname(target)).catch(() => null)
+      if (!certifiDir || !certifiDir.isDirectory()) continue
+    } else if (stat.size === managed.length) {
+      const current = await fs.promises.readFile(target).catch(() => null)
+      if (current && current.equals(managed)) continue
+    }
+    const temporary = path.join(path.dirname(target), `.cacert-${randomUUID()}.tmp`)
+    try {
+      await fs.promises.writeFile(temporary, managed, { mode: stat ? stat.mode & 0o777 : 0o644 })
+      await fs.promises.rename(temporary, target)
+      repaired.push(target)
+    } catch (error) {
+      // The caller decides what a failed replacement means; it needs to know which file.
+      error.target = target
+      error.prefix = prefix
+      throw error
+    } finally {
+      await fs.promises.rm(temporary, { force: true }).catch(() => {})
+    }
+  }
+  return repaired
+}
+
+// An in-app link to a folder under the Pinokio home: the app file explorer for anything under
+// api/, the home directory listing for everything else. Both are served by the daemon, so the
+// link works from any client, including a browser on another machine.
+function explorerHref(homedir, dir) {
+  const relative = path.relative(path.resolve(homedir), path.resolve(dir))
+  if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) return null
+  const segments = relative.split(path.sep).map(encodeURIComponent)
+  return segments[0] === 'api' ? `/${segments.join('/')}` : `/files/${segments.join('/')}`
+}
+
+module.exports = {
+  managedCertPaths,
+  applyManagedCertEnv,
+  pipVendoredBundles,
+  repairPipVendoredBundle,
+  explorerHref,
+}

package/kernel/shell.js

@@ -23,6 +23,8 @@ const ShellStateSync = require('./shell_state_sync')
 const ShellRunTemplate = require('./api/shell_run_template')
 const { PYTHON_INSTALL_SPEC, PIP_WHEEL, PIP_SEED_SCRIPT } = require('./bin/conda-pins')
 const CondaRuntimeGuard = require('./shell_conda_runtime_guard')
+const { managedCertPaths, applyManagedCertEnv, repairPipVendoredBundle, explorerHref } = require('./cert_env')
+const escapeHtml = require('escape-html')
 const home = os.homedir()
 const WINDOWS_CMD_CONDA_COMMAND_PATTERN = /(?:^|[&|()]\s*)@?\s*(?:call\s+)?(?:"[^"]*[\\/]conda(?:\.bat|\.exe)?"|(?:[a-z]:)?[^&|()\s"]*[\\/]conda(?:\.bat|\.exe)?|conda(?:\.bat|\.exe)?)\s+/i
 
@@ -307,15 +309,14 @@ class Shell {
     setDefaultEnvValue(this.env, "HF_HUB_DISABLE_UPDATE_CHECK", "1")
     setDefaultEnvValue(this.env, "HF_TOKEN_PATH", this.kernel.envs?.HF_TOKEN_PATH || path.resolve(this.kernel.homedir, "cache", "HF_AUTH", "token"))
 
-    if (this.platform === "win32") {
-      const managedSslDir = path.resolve(this.kernel.homedir, "bin", "miniforge", "Library", "ssl")
-      const managedCertFile = path.resolve(managedSslDir, "cacert.pem")
-      const managedCertFileExists = await fs.promises.access(managedCertFile).then(() => true).catch(() => false)
-      if (managedCertFileExists) {
-        setDefaultEnvValue(this.env, "SSL_CERT_FILE", managedCertFile)
-        setDefaultEnvValue(this.env, "SSL_CERT_DIR", managedSslDir)
-      }
+    // Point every app's Python HTTPS trust (httpx, requests, pip, the ssl module) at the
+    // managed CA bundle instead of the certifi copy frozen inside each environment.
+    const managedCert = managedCertPaths(this.kernel.homedir, this.platform)
+    if (await fs.promises.access(managedCert.file).then(() => true).catch(() => false)) {
+      applyManagedCertEnv(this.env, { ...managedCert, platform: this.platform })
+    }
 
+    if (this.platform === "win32") {
       // Hugging Face file symlinks regularly fail on non-admin Windows setups.
       // Default to no-symlink cache mode unless the user/app explicitly overrides it.
       setDefaultEnvValue(this.env, "HF_HUB_DISABLE_SYMLINKS", "1")
@@ -945,6 +946,44 @@ class Shell {
   exists(abspath) {
     return new Promise(r=>fs.access(abspath, fs.constants.F_OK, e => r(!e)))
   }
+  // pip ignores the certificate environment for the certifi copy it carries, so an existing
+  // environment's pip is brought in line by replacing that one file with the managed bundle.
+  // Runs for the environment being activated only; a match costs one file read.
+  // A replacement that fails stops the launch: the app must not run against a stale list
+  // without the user knowing. They are told which file to delete, and relaunching retries.
+  async repairPipCertBundle(prefix) {
+    const managedCert = managedCertPaths(this.kernel.homedir, this.platform)
+    let repaired
+    try {
+      repaired = await repairPipVendoredBundle(prefix, managedCert.file, this.platform)
+    } catch (error) {
+      const target = error.target || prefix
+      const reason = error.message
+      const message = `Pinokio could not replace pip's certificate file for this app (${reason}). Delete this file, then launch the app again: ${target}`
+      if (typeof this.ondata === "function") {
+        const href = explorerHref(this.kernel.homedir, path.dirname(target))
+        this.ondata({
+          html: [
+            `<b>Certificate update blocked</b>`,
+            `Pinokio could not replace pip's certificate file for this app (${escapeHtml(reason)}).`,
+            `Delete this file, then launch the app again:`,
+            `<code>${escapeHtml(target)}</code>`,
+            ...(href ? [`Click to open the folder.`] : []),
+          ].join("<br>"),
+          ...(href ? { href, target: "self" } : {}),
+          type: "error",
+        }, "notify")
+      }
+      const blocked = new Error(message)
+      blocked.path = target
+      blocked.cause = error
+      throw blocked
+    }
+    for (const target of repaired) {
+      console.log(`[cert] replaced pip's vendored CA bundle: ${target}`)
+    }
+    return repaired
+  }
   build (params) {
     if (params.message) {
       if (typeof params.message === "string") {
@@ -1125,6 +1164,7 @@ class Shell {
         : this.quoteArgForShell(env_path)
       let env_exists = await this.exists(env_path)
       if (env_exists) {
+        await this.repairPipCertBundle(env_path)
         conda_activation = [
           conda_hook,
 //          timeout,
@@ -1165,6 +1205,7 @@ class Shell {
         let env_path = path.resolve(envs_path, conda_name)
         let env_exists = await this.exists(env_path)
         if (env_exists) {
+          await this.repairPipCertBundle(env_path)
           conda_activation = [
             conda_hook,
 //            timeout,
@@ -1366,6 +1407,7 @@ class Shell {
         let deactivate_path = (windowsBashVenv ? "deactivate" : (this.platform === 'win32' ? path.resolve(env_path, "Scripts", "deactivate") : "deactivate"))
         let env_exists = await this.exists(env_path)
         if (env_exists) {
+          await this.repairPipCertBundle(env_path)
           if (use_uv) {
             venv_activation = [
 //              `python -m venv --upgrade ${env_path}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.2.20",
+  "version": "8.2.22",
   "description": "",
   "main": "index.js",
   "scripts": {

package/server/index.js

@@ -1049,7 +1049,8 @@ class Server {
     const dnsName = anywhere && typeof anywhere.dnsNameFrom === "function" ? anywhere.dnsNameFrom(anywhere.lastStatus) : null
     return !!dnsName && parsed.protocol === "https:" && host === dnsName.toLowerCase()
   }
-  // the app's menu as launch targets: scripts and web addresses, never interface links
+  // the app's menu as launch targets: scripts and web addresses, never interface links;
+  // text is plain: a launcher may write HTML, which the desktop renders and the phone does not
   async anywhereMenu(api, repoPath) {
     const items = []
     for (const { item, target } of await launcherMenuTargets(api, repoPath)) {
@@ -1057,7 +1058,7 @@ class Server {
       if (!web && !/\.(js|json)$/i.test(target.uri)) continue
       if (isInterfaceLink(target.input)) continue
       items.push({
-        text: item.text || "",
+        text: String(item.text || "").replace(/<[^>]*>/g, " ").replace(/\s+/g, " ").trim(),
         icon: item.icon || "",
         href: target.href,
         default: !!item.default,

package/server/public/remote-control.svg

@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 40 40">
+  <defs>
+    <mask id="cursor-gap" maskUnits="userSpaceOnUse" x="0" y="0" width="40" height="40">
+      <rect width="40" height="40" fill="white"/>
+      <path d="M23 17V35L28 30L32 38L36 36L32 28L39 27Z" fill="black" stroke="black" stroke-width="3" stroke-linejoin="round"/>
+    </mask>
+  </defs>
+  <g mask="url(#cursor-gap)">
+    <path fill-rule="evenodd" d="M5 5H33A3 3 0 0 1 36 8V26A3 3 0 0 1 33 29H5A3 3 0 0 1 2 26V8A3 3 0 0 1 5 5ZM6 9V25H32V9Z"/>
+    <path d="M17 29H22V34H29V38H10V34H17Z"/>
+  </g>
+  <path d="M23 17V35L28 30L32 38L36 36L32 28L39 27Z"/>
+</svg>

package/server/public/style.css

@@ -1598,6 +1598,11 @@ body.dark .main-sidebar .main-sidebar-status-badge[data-state="on"] {
   -webkit-mask: url('/pinokio-mark.svg') center / 14px 14px no-repeat;
   mask: url('/pinokio-mark.svg') center / 14px 14px no-repeat;
 }
+.main-sidebar .remote-control-icon {
+  background: currentColor;
+  -webkit-mask: url('/remote-control.svg') center / contain no-repeat;
+  mask: url('/remote-control.svg') center / contain no-repeat;
+}
 @media only screen and (min-width: 601px) {
   body.main-sidebar-page {
     display: flex;

package/server/views/anywhere.ejs

@@ -1,6 +1,6 @@
 <html>
 <head>
-<title>Pinokio Anywhere</title>
+<title>Pinokio Remote</title>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" />
 <% if (locals.anywhere_host) { %>
@@ -132,7 +132,7 @@ document.addEventListener('DOMContentLoaded', function() {
   <section class='task-shell anywhere-shell'>
     <header class='task-shell-header'>
       <div class='task-shell-header-main'>
-        <h1 class='task-title'>Pinokio Anywhere</h1>
+        <h1 class='task-title'>Remote</h1>
         <p class='task-description'>Open this Pinokio and its running apps from your phone or another computer, anywhere, over a private encrypted network.</p>
       </div>
       <div class='task-header-actions'>
@@ -146,7 +146,7 @@ document.addEventListener('DOMContentLoaded', function() {
 
         <div class='anywhere-state' data-state='off'>
           <div class='anywhere-card'>
-            <h2>Pinokio Anywhere is off</h2>
+            <h2>Remote access is off</h2>
             <p>Turn it on to reach this computer from your phone. Nothing is exposed to the public internet: only devices signed in to your own Tailscale account can connect.</p>
             <p><button class='anywhere-btn' data-action='start'><i class="fa-solid fa-power-off"></i> Turn on</button></p>
           </div>
@@ -162,7 +162,7 @@ document.addEventListener('DOMContentLoaded', function() {
         <div class='anywhere-state' data-state='login'>
           <div class='anywhere-card'>
             <h2>Sign in in your browser</h2>
-            <p>Pinokio Anywhere uses <b>Tailscale</b>, a free private network. Sign in with a <b>personal</b> Google, Apple, GitHub or Microsoft account. You will use the same account on your phone.</p>
+            <p>Remote access uses <b>Tailscale</b>, a free private network. Sign in with a <b>personal</b> Google, Apple, GitHub or Microsoft account. You will use the same account on your phone.</p>
             <p><a class='anywhere-btn' id='anywhere-login-link' href='#' target='_blank' rel='noopener'><i class="fa-solid fa-arrow-up-right-from-square"></i> Sign in with Tailscale</a></p>
             <p class='anywhere-muted'>Waiting for you to finish signing in… <span id='anywhere-login-url' class='anywhere-muted'></span></p>
           </div>

package/server/views/partials/main_sidebar.ejs

@@ -40,7 +40,7 @@
     <div class='main-sidebar-section' aria-label="Configure">
       <div class="main-sidebar-section-title">Configure</div>
       <a href="/network" class="tab <%= sidebarSelected === 'network' ? 'selected' : '' %>" data-main-sidebar-home-server-tab><i class="fa-solid fa-wifi"></i><div class='caption'>Home Server</div><span class="main-sidebar-status-badge" data-main-sidebar-home-server-status aria-hidden="true" hidden></span></a>
-      <a href="/anywhere" class="tab <%= sidebarSelected === 'anywhere' ? 'selected' : '' %>" data-main-sidebar-anywhere-tab><i class="fa-solid fa-mobile-screen"></i><div class='caption'>Pinokio Anywhere</div><span class="main-sidebar-status-badge" data-main-sidebar-anywhere-status aria-hidden="true" hidden></span></a>
+      <a href="/anywhere" class="tab <%= sidebarSelected === 'anywhere' ? 'selected' : '' %>" data-main-sidebar-anywhere-tab><span class="main-sidebar-action-icon remote-control-icon" aria-hidden="true"></span><div class='caption'>Remote</div><span class="main-sidebar-status-badge" data-main-sidebar-anywhere-status aria-hidden="true" hidden></span></a>
       <a class="tab <%= sidebarSelected === 'autolaunch' ? 'selected' : '' %>" href="/autolaunch"><i class="fa-solid fa-power-off"></i><div class='caption'>Autolaunch</div></a>
       <a href="/connect" class="tab <%= sidebarSelected === 'connect' ? 'selected' : '' %>"><i class="fa-solid fa-plug"></i><div class='caption'>Login</div></a>
       <a class="tab <%= sidebarSelected === 'settings' ? 'selected' : '' %>" href="/home?mode=settings"><i class="fa-solid fa-gear"></i><div class='caption'>Settings</div></a>
@@ -140,7 +140,7 @@
         badge.textContent = label;
         badge.hidden = false;
         badge.dataset.state = on ? "on" : "off";
-        tab.setAttribute("title", `Pinokio Anywhere ${label}`);
+        tab.setAttribute("title", `Remote ${label}`);
       };
       document.addEventListener("pinokio:anywhere-status", (event) => {
         const detail = event && event.detail ? event.detail : {};

package/test/anywhere-api.test.js

@@ -164,6 +164,7 @@ const menu = [
     { text: 'Start (low VRAM)', href: 'start.js', params: { lowvram: true } },
   ] },
   { text: 'Web UI', icon: 'fa-solid fa-rocket', href: 'http://127.0.0.1:7860' },
+  { text: '<div><strong>Tunnel</strong>\n<div>Start first, then run again.</div></div>', href: 'tunnel.js' },
   { text: 'Edit start', href: 'start.js?fs=view' },
   { text: 'View source', href: 'start.js?mode=source' },
   { text: 'Models', href: 'models?fs=true' },
@@ -178,6 +179,7 @@ test('launch returns the flattened launchable menu when there is no default', as
     { text: 'Start', icon: '', href: 'start.js' },
     { text: 'Start (low VRAM)', icon: '', href: 'start.js?lowvram=true' },
     { text: 'Web UI', icon: 'fa-solid fa-rocket', href: 'http://127.0.0.1:7860' },
+    { text: 'Tunnel Start first, then run again.', icon: '', href: 'tunnel.js' },
   ] } })
   assert.deepEqual(h.calls.process, [])
 })

package/test/cert-env.test.js

@@ -0,0 +1,315 @@
+const assert = require('node:assert/strict')
+const fs = require('node:fs/promises')
+const os = require('node:os')
+const path = require('node:path')
+const test = require('node:test')
+
+const {
+  managedCertPaths,
+  applyManagedCertEnv,
+  pipVendoredBundles,
+  repairPipVendoredBundle,
+} = require('../kernel/cert_env')
+const Shell = require('../kernel/shell')
+
+const MANAGED = '# managed bundle\n-----BEGIN CERTIFICATE-----\nnew\n-----END CERTIFICATE-----\n'
+const STALE = '# stale bundle\n-----BEGIN CERTIFICATE-----\nold\n-----END CERTIFICATE-----\n'
+
+async function tempRoot(t, prefix) {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), prefix))
+  t.after(() => fs.rm(root, { recursive: true, force: true }).catch(() => {}))
+  return root
+}
+
+async function managedBundle(t, platform) {
+  const root = await tempRoot(t, 'pinokio-cert-env-')
+  const paths = managedCertPaths(root, platform)
+  await fs.mkdir(paths.dir, { recursive: true })
+  await fs.writeFile(paths.file, MANAGED)
+  return { root, ...paths }
+}
+
+function createKernel(root) {
+  return {
+    homedir: root,
+    bracketedPasteSupport: {},
+    connect: { keys: async () => null },
+    envs: {},
+    exists: async filepath => fs.access(filepath).then(() => true).catch(() => false),
+    which: () => null,
+    path: (...parts) => path.join(root, ...parts),
+    bin: { path: (...parts) => path.join(root, 'bin', ...parts) },
+  }
+}
+
+test('managedCertPaths follows the Miniforge layout per platform', () => {
+  assert.equal(managedCertPaths('/home/u/pinokio', 'darwin').file, path.resolve('/home/u/pinokio/bin/miniforge/ssl/cacert.pem'))
+  assert.equal(managedCertPaths('/home/u/pinokio', 'linux').file, path.resolve('/home/u/pinokio/bin/miniforge/ssl/cacert.pem'))
+  assert.equal(managedCertPaths('C:\\pinokio', 'win32').file, path.resolve('C:\\pinokio', 'bin', 'miniforge', 'Library', 'ssl', 'cacert.pem'))
+})
+
+test('applyManagedCertEnv points httpx, requests and pip at the managed bundle', () => {
+  const env = applyManagedCertEnv({}, { file: '/m/cacert.pem', dir: '/m', platform: 'darwin' })
+  assert.equal(env.SSL_CERT_FILE, '/m/cacert.pem')
+  assert.equal(env.REQUESTS_CA_BUNDLE, '/m/cacert.pem')
+  assert.equal(env.PIP_CERT, '/m/cacert.pem')
+  assert.equal(env.SSL_CERT_DIR, undefined, 'SSL_CERT_DIR stays a Windows-only uv workaround')
+  assert.equal(env.CURL_CA_BUNDLE, undefined, 'curl keeps its own trust source')
+})
+
+test('applyManagedCertEnv also gives Windows uv a certificate directory', () => {
+  const env = applyManagedCertEnv({}, { file: 'C:\\m\\cacert.pem', dir: 'C:\\m', platform: 'win32' })
+  assert.equal(env.SSL_CERT_FILE, 'C:\\m\\cacert.pem')
+  assert.equal(env.SSL_CERT_DIR, 'C:\\m')
+  assert.equal(env.REQUESTS_CA_BUNDLE, 'C:\\m\\cacert.pem')
+  assert.equal(env.PIP_CERT, 'C:\\m\\cacert.pem')
+})
+
+test('applyManagedCertEnv never overrides a custom trust setting or its higher-priority sibling', () => {
+  const managed = { file: '/m/cacert.pem', dir: '/m', platform: 'darwin' }
+
+  // httpx prefers SSL_CERT_FILE over SSL_CERT_DIR: a custom directory must not be masked.
+  const dirOnly = applyManagedCertEnv({ SSL_CERT_DIR: '/corp/certs' }, managed)
+  assert.equal(dirOnly.SSL_CERT_FILE, undefined)
+  assert.equal(dirOnly.SSL_CERT_DIR, '/corp/certs')
+  assert.equal(dirOnly.REQUESTS_CA_BUNDLE, '/m/cacert.pem')
+
+  // requests prefers REQUESTS_CA_BUNDLE over CURL_CA_BUNDLE: a custom curl bundle must not be masked.
+  const curlOnly = applyManagedCertEnv({ CURL_CA_BUNDLE: '/corp/curl.pem' }, managed)
+  assert.equal(curlOnly.REQUESTS_CA_BUNDLE, undefined)
+  assert.equal(curlOnly.CURL_CA_BUNDLE, '/corp/curl.pem')
+  assert.equal(curlOnly.SSL_CERT_FILE, '/m/cacert.pem')
+
+  const custom = applyManagedCertEnv({ SSL_CERT_FILE: '/corp/a.pem', REQUESTS_CA_BUNDLE: '/corp/b.pem', PIP_CERT: '/corp/c.pem' }, managed)
+  assert.equal(custom.SSL_CERT_FILE, '/corp/a.pem')
+  assert.equal(custom.REQUESTS_CA_BUNDLE, '/corp/b.pem')
+  assert.equal(custom.PIP_CERT, '/corp/c.pem')
+
+  // Empty values count as unset, and the existing key casing is reused (Windows env is case-insensitive).
+  const empty = applyManagedCertEnv({ ssl_cert_file: '', Pip_Cert: '  ' }, { ...managed, platform: 'win32' })
+  assert.equal(empty.ssl_cert_file, '/m/cacert.pem')
+  assert.equal(empty.SSL_CERT_FILE, undefined)
+  assert.equal(empty.Pip_Cert, '/m/cacert.pem')
+  assert.equal(empty.PIP_CERT, undefined)
+})
+
+test('pipVendoredBundles finds pip inside venv and conda prefixes on every platform', async t => {
+  const root = await tempRoot(t, 'pinokio-pip-bundles-')
+  const posix = path.join(root, 'env')
+  await fs.mkdir(path.join(posix, 'lib', 'python3.10', 'site-packages'), { recursive: true })
+  await fs.mkdir(path.join(posix, 'lib', 'python3.12', 'site-packages'), { recursive: true })
+  await fs.mkdir(path.join(posix, 'lib', 'pkgconfig'), { recursive: true })
+  assert.deepEqual(await pipVendoredBundles(posix, 'linux'), [
+    path.join(posix, 'lib', 'python3.10', 'site-packages', 'pip', '_vendor', 'certifi', 'cacert.pem'),
+    path.join(posix, 'lib', 'python3.12', 'site-packages', 'pip', '_vendor', 'certifi', 'cacert.pem'),
+  ])
+  assert.deepEqual(await pipVendoredBundles(path.join(root, 'win'), 'win32'), [
+    path.join(root, 'win', 'Lib', 'site-packages', 'pip', '_vendor', 'certifi', 'cacert.pem'),
+  ])
+  assert.deepEqual(await pipVendoredBundles(path.join(root, 'missing'), 'linux'), [])
+})
+
+test('repairPipVendoredBundle replaces a stale pip bundle once and leaves everything else alone', async t => {
+  const managed = await managedBundle(t, 'linux')
+  const prefix = path.join(managed.root, 'api', 'app', 'env')
+  const certifiDir = path.join(prefix, 'lib', 'python3.10', 'site-packages', 'pip', '_vendor', 'certifi')
+  const target = path.join(certifiDir, 'cacert.pem')
+  const sibling = path.join(certifiDir, 'core.py')
+  await fs.mkdir(certifiDir, { recursive: true })
+  await fs.writeFile(target, STALE, { mode: 0o600 })
+  await fs.writeFile(sibling, 'print("untouched")\n')
+
+  assert.deepEqual(await repairPipVendoredBundle(prefix, managed.file, 'linux'), [target])
+  assert.equal(await fs.readFile(target, 'utf8'), MANAGED)
+  if (process.platform !== 'win32') {
+    assert.equal((await fs.stat(target)).mode & 0o777, 0o600, 'file mode is preserved')
+  }
+  assert.equal(await fs.readFile(sibling, 'utf8'), 'print("untouched")\n')
+  assert.deepEqual(await fs.readdir(certifiDir), ['cacert.pem', 'core.py'], 'no temporary files are left behind')
+
+  // Second activation: the bundle matches, nothing is written.
+  const before = await fs.stat(target)
+  assert.deepEqual(await repairPipVendoredBundle(prefix, managed.file, 'linux'), [])
+  assert.equal((await fs.stat(target)).mtimeMs, before.mtimeMs)
+})
+
+test('repairPipVendoredBundle is a no-op without pip or without a managed bundle', async t => {
+  const managed = await managedBundle(t, 'linux')
+  const uvVenv = path.join(managed.root, 'uv-env')
+  await fs.mkdir(path.join(uvVenv, 'lib', 'python3.11', 'site-packages'), { recursive: true })
+  assert.deepEqual(await repairPipVendoredBundle(uvVenv, managed.file, 'linux'), [])
+
+  const prefix = path.join(managed.root, 'env')
+  const target = path.join(prefix, 'lib', 'python3.10', 'site-packages', 'pip', '_vendor', 'certifi', 'cacert.pem')
+  await fs.mkdir(path.dirname(target), { recursive: true })
+  await fs.writeFile(target, STALE)
+  assert.deepEqual(await repairPipVendoredBundle(prefix, path.join(managed.root, 'nope.pem'), 'linux'), [])
+  assert.equal(await fs.readFile(target, 'utf8'), STALE)
+})
+
+test('Shell.init_env applies the managed certificate defaults on every platform when the bundle exists', async t => {
+  for (const platform of ['darwin', 'linux', 'win32']) {
+    const managed = await managedBundle(t, platform)
+    await fs.mkdir(path.join(managed.root, 'api'), { recursive: true })
+    const shell = new Shell(createKernel(managed.root))
+    shell.platform = platform
+    await shell.init_env({ path: process.cwd(), env: {} })
+    assert.equal(shell.env.SSL_CERT_FILE, managed.file, platform)
+    assert.equal(shell.env.REQUESTS_CA_BUNDLE, managed.file, platform)
+    assert.equal(shell.env.PIP_CERT, managed.file, platform)
+    assert.equal(shell.env.SSL_CERT_DIR, platform === 'win32' ? managed.dir : undefined, platform)
+
+    const custom = new Shell(createKernel(managed.root))
+    custom.platform = platform
+    await custom.init_env({ path: process.cwd(), env: { CURL_CA_BUNDLE: '/corp/curl.pem', SSL_CERT_DIR: '/corp/certs' } })
+    assert.equal(custom.env.SSL_CERT_FILE, undefined, platform)
+    assert.equal(custom.env.REQUESTS_CA_BUNDLE, undefined, platform)
+    assert.equal(custom.env.PIP_CERT, managed.file, platform)
+  }
+})
+
+test('Shell.init_env sets nothing when the managed bundle is absent', async t => {
+  const root = await tempRoot(t, 'pinokio-cert-env-missing-')
+  await fs.mkdir(path.join(root, 'api'), { recursive: true })
+  const shell = new Shell(createKernel(root))
+  shell.platform = 'darwin'
+  await shell.init_env({ path: process.cwd(), env: {} })
+  assert.equal(shell.env.SSL_CERT_FILE, undefined)
+  assert.equal(shell.env.REQUESTS_CA_BUNDLE, undefined)
+  assert.equal(shell.env.PIP_CERT, undefined)
+})
+
+test('Shell.activate repairs pip in the venv and custom conda env being activated, never in base', async t => {
+  const managed = await managedBundle(t, 'linux')
+  const kernel = createKernel(managed.root)
+  const app = path.join(managed.root, 'api', 'app')
+  const stalePip = async prefix => {
+    const target = path.join(prefix, 'lib', 'python3.10', 'site-packages', 'pip', '_vendor', 'certifi', 'cacert.pem')
+    await fs.mkdir(path.dirname(target), { recursive: true })
+    await fs.writeFile(target, STALE)
+    return target
+  }
+  const venv = await stalePip(path.join(app, 'env'))
+  const condaByPath = await stalePip(path.join(app, 'conda-env'))
+  const condaByName = await stalePip(kernel.bin.path('miniforge', 'envs', 'custom'))
+  const base = await stalePip(kernel.bin.path('miniforge'))
+  await fs.mkdir(path.join(app, 'env', 'bin'), { recursive: true })
+
+  const shell = new Shell(kernel)
+  shell.platform = 'linux'
+  shell.shell = 'bash'
+  shell.env = {}
+  shell.conda_hook = () => 'conda hook'
+  shell.condaRuntimeGuard = null
+
+  await shell.activate({ path: app, venv: 'env', message: ['true'] })
+  assert.equal(await fs.readFile(venv, 'utf8'), MANAGED)
+  assert.equal(await fs.readFile(base, 'utf8'), STALE, 'base is managed by the runtime seed, not by activation')
+
+  await shell.activate({ path: app, conda: { path: 'conda-env' }, message: ['true'] })
+  assert.equal(await fs.readFile(condaByPath, 'utf8'), MANAGED)
+
+  await shell.activate({ path: app, conda: { name: 'custom' }, message: ['true'] })
+  assert.equal(await fs.readFile(condaByName, 'utf8'), MANAGED)
+  assert.equal(await fs.readFile(base, 'utf8'), STALE)
+})
+
+const { explorerHref } = require('../kernel/cert_env')
+
+test('explorerHref links into the app file explorer under api/ and the home listing elsewhere', () => {
+  const home = path.resolve('/home/u/pinokio')
+  assert.equal(explorerHref(home, path.join(home, 'api', 'my app.git', 'app', 'env', 'lib', 'python3.10', 'site-packages', 'pip', '_vendor', 'certifi')),
+    '/api/my%20app.git/app/env/lib/python3.10/site-packages/pip/_vendor/certifi')
+  assert.equal(explorerHref(home, path.join(home, 'bin', 'miniforge', 'envs', 'custom', 'lib', 'python3.10', 'site-packages', 'pip', '_vendor', 'certifi')),
+    '/files/bin/miniforge/envs/custom/lib/python3.10/site-packages/pip/_vendor/certifi')
+  assert.equal(explorerHref(home, '/elsewhere/env'), null)
+})
+
+const canTestPermissions = process.platform !== 'win32' && typeof process.getuid === 'function' && process.getuid() !== 0
+
+test('a pip bundle that cannot be replaced blocks the launch, names the file, and notifies the app page', { skip: !canTestPermissions && 'needs a non-root POSIX user' }, async t => {
+  const managed = await managedBundle(t, 'linux')
+  const kernel = createKernel(managed.root)
+  const app = path.join(managed.root, 'api', 'demo.git')
+  const prefix = path.join(app, 'app', 'env')
+  const certifiDir = path.join(prefix, 'lib', 'python3.10', 'site-packages', 'pip', '_vendor', 'certifi')
+  const target = path.join(certifiDir, 'cacert.pem')
+  await fs.mkdir(certifiDir, { recursive: true })
+  await fs.writeFile(target, STALE)
+  await fs.chmod(certifiDir, 0o500)
+  t.after(() => fs.chmod(certifiDir, 0o700).catch(() => {}))
+
+  const shell = new Shell(kernel)
+  shell.platform = 'linux'
+  const packets = []
+  shell.ondata = (stream, type) => packets.push({ stream, type })
+
+  await assert.rejects(() => shell.repairPipCertBundle(prefix), error => {
+    assert.match(error.message, /could not replace pip's certificate file/)
+    assert.match(error.message, /Delete this file, then launch the app again/)
+    assert.ok(error.message.includes(target), 'the message names the file to delete')
+    assert.equal(error.path, target)
+    return true
+  })
+  assert.equal(await fs.readFile(target, 'utf8'), STALE, 'the original file is left untouched')
+  assert.deepEqual(await fs.readdir(certifiDir), ['cacert.pem'], 'no temporary file is left behind')
+
+  assert.equal(packets.length, 1)
+  assert.equal(packets[0].type, 'notify')
+  const notice = packets[0].stream
+  assert.equal(notice.type, 'error')
+  assert.equal(notice.target, 'self')
+  assert.equal(notice.href, '/api/demo.git/app/env/lib/python3.10/site-packages/pip/_vendor/certifi')
+  assert.ok(notice.html.includes('Delete this file, then launch the app again'))
+  assert.ok(notice.html.includes(escapeForHtml(target)))
+
+  // The user deletes the file and launches again: the fresh bundle is written and the launch proceeds.
+  await fs.chmod(certifiDir, 0o700)
+  await fs.rm(target)
+  assert.deepEqual(await shell.repairPipCertBundle(prefix), [target])
+  assert.equal(await fs.readFile(target, 'utf8'), MANAGED)
+  if (process.platform !== 'win32') {
+    assert.equal((await fs.stat(target)).mode & 0o777, 0o644, 'a recreated file gets a normal mode')
+  }
+})
+
+test('repairPipVendoredBundle recreates a deleted bundle when pip is present, and ignores an absent pip', async t => {
+  const managed = await managedBundle(t, 'linux')
+  const prefix = path.join(managed.root, 'env')
+  const certifiDir = path.join(prefix, 'lib', 'python3.10', 'site-packages', 'pip', '_vendor', 'certifi')
+  const target = path.join(certifiDir, 'cacert.pem')
+  await fs.mkdir(certifiDir, { recursive: true })
+  assert.deepEqual(await repairPipVendoredBundle(prefix, managed.file, 'linux'), [target])
+  assert.equal(await fs.readFile(target, 'utf8'), MANAGED)
+
+  const noPip = path.join(managed.root, 'nopip')
+  await fs.mkdir(path.join(noPip, 'lib', 'python3.10', 'site-packages'), { recursive: true })
+  assert.deepEqual(await repairPipVendoredBundle(noPip, managed.file, 'linux'), [])
+  assert.equal(await fs.stat(path.join(noPip, 'lib', 'python3.10', 'site-packages', 'pip')).catch(() => null), null, 'nothing is created where pip is absent')
+})
+
+test('Shell.activate stops the step when the pip bundle cannot be replaced', { skip: !canTestPermissions && 'needs a non-root POSIX user' }, async t => {
+  const managed = await managedBundle(t, 'linux')
+  const kernel = createKernel(managed.root)
+  const app = path.join(managed.root, 'api', 'demo.git')
+  const certifiDir = path.join(app, 'env', 'lib', 'python3.10', 'site-packages', 'pip', '_vendor', 'certifi')
+  await fs.mkdir(certifiDir, { recursive: true })
+  await fs.mkdir(path.join(app, 'env', 'bin'), { recursive: true })
+  await fs.writeFile(path.join(certifiDir, 'cacert.pem'), STALE)
+  await fs.chmod(certifiDir, 0o500)
+  t.after(() => fs.chmod(certifiDir, 0o700).catch(() => {}))
+
+  const shell = new Shell(kernel)
+  shell.platform = 'linux'
+  shell.shell = 'bash'
+  shell.env = {}
+  shell.ondata = () => {}
+  shell.conda_hook = () => 'conda hook'
+  shell.condaRuntimeGuard = null
+  await assert.rejects(() => shell.activate({ path: app, venv: 'env', message: ['true'] }), /could not replace pip's certificate file/)
+  await fs.chmod(certifiDir, 0o700)
+})
+
+function escapeForHtml(value) {
+  return require('escape-html')(value)
+}

package/test/conda-bin.test.js

@@ -471,6 +471,65 @@ test('Conda replacement stops a running managed Caddy without restoring it', asy
   assert.equal(caddyRunning, false)
 })
 
+test('Conda replacement waits for Anywhere shutdown before deleting either runtime', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-anywhere-stop-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  const miniforge = await createMiniforge(root)
+  const miniconda = await createLegacyMiniconda(root)
+  const kernel = createKernel(root, 'win32')
+  let finishStop
+  let enteredStop
+  const stopping = new Promise(resolve => { enteredStop = resolve })
+  const stopped = new Promise(resolve => { finishStop = resolve })
+  kernel.anywhere = { stop: async () => { enteredStop(); await stopped } }
+  kernel.bin.mods = []
+  kernel.bin.download = async () => {}
+  kernel.bin.rm = async () => {}
+  let bootstrapped = false
+  kernel.bin.exec = async payload => {
+    if (payload.conda?.skip) {
+      bootstrapped = true
+      assert.equal(await pathExists(miniforge), false)
+      assert.equal(await pathExists(miniconda), false)
+      await fs.mkdir(path.join(miniforge, 'conda-meta'), { recursive: true })
+      await fs.writeFile(path.join(miniforge, 'python.exe'), 'fake python\n')
+    }
+  }
+
+  const conda = createConda(kernel)
+  const installing = conda._install({ dependencies: [] }, () => {})
+  try {
+    await stopping
+    await new Promise(setImmediate)
+    assert.equal(await pathExists(path.join(miniforge, 'Scripts/conda.exe')), true)
+    assert.equal(await pathExists(path.join(miniconda, 'Scripts/conda.exe')), true)
+    assert.equal(bootstrapped, false)
+  } finally {
+    finishStop()
+    await installing
+  }
+  assert.equal(bootstrapped, true)
+})
+
+test('Conda replacement preserves both runtimes when Anywhere shutdown fails', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-anywhere-failure-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  const miniforge = await createMiniforge(root)
+  const miniconda = await createLegacyMiniconda(root)
+  const kernel = createKernel(root, 'win32')
+  const failure = new Error('tailscaled did not stop')
+  kernel.anywhere = { stop: async () => { throw failure } }
+  kernel.bin.download = async () => {}
+  kernel.bin.exec = async () => assert.fail('installer must not run after shutdown failure')
+  const conda = createConda(kernel)
+  conda.removeInstallPath = async () => assert.fail('runtime deletion must not start after shutdown failure')
+
+  await assert.rejects(conda._install({ dependencies: [] }, () => {}), error => error === failure)
+
+  assert.equal(await fs.readFile(path.join(miniforge, 'Scripts/conda.exe'), 'utf8'), 'fake conda\n')
+  assert.equal(await fs.readFile(path.join(miniconda, 'Scripts/conda.exe'), 'utf8'), 'fake conda\n')
+})
+
 test('Conda install replaces legacy miniconda with a compatibility alias to miniforge', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-miniforge-alias-'))
   const legacy = await createLegacyMiniconda(root)