pinokiod 8.2.22 → 8.2.23

package/kernel/connect/providers/huggingface/index.js

@@ -253,12 +253,17 @@ class Huggingface {
       if (this.kernel.envs && result.env.HF_TOKEN_PATH === this.defaultTokenPath()) {
         this.kernel.envs.HF_TOKEN_PATH = result.env.HF_TOKEN_PATH
       }
-      return true
+      return options.details === true ? { connected: true, invalid: false } : true
     } catch (error) {
-      if (this.kernel.envs && error.tokenPath === this.defaultTokenPath()) {
+      // Match the pinned hf CLI's authentication errors, not arbitrary command failures.
+      const invalid = !error.killed && (
+        (error.code === 1 && /^Error: (?:Invalid user token\.[^\r\n]*|Not logged in)\r?$/m.test(stripAnsi(error.stderr))) ||
+        (typeof error.path === "string" && error.path === error.tokenPath && ["EISDIR", "ENOTDIR", "ENOTEMPTY"].includes(error.code))
+      )
+      if (invalid && this.kernel.envs && error.tokenPath === this.defaultTokenPath()) {
         this.kernel.envs.HF_TOKEN_PATH = this.kernel.path("cache", "HF_AUTH", "anonymous")
       }
-      return false
+      return options.details === true ? { connected: false, invalid } : false
     }
   }
   async profile() {

package/kernel/shells.js

@@ -47,8 +47,8 @@ class Shells {
   }
 */
   async init() {
-    const hfDisconnected = !this.kernel.envs?.HF_TOKEN_PATH &&
-      !(await this.kernel.connect.connected("huggingface", { timeout: 5000 }))
+    const hfInvalid = !this.kernel.envs?.HF_TOKEN_PATH &&
+      (await this.kernel.connect.connected("huggingface", { timeout: 5000, details: true }))?.invalid === true
 
     // iterate through all the envs
     let sh = new Shell(this.kernel)
@@ -61,7 +61,7 @@ class Shells {
     await sh.init_env({
       env: this.kernel.bin.envs({}),
     })
-    if (hfDisconnected && sh.env.HF_TOKEN_PATH === this.kernel.path("cache", "HF_AUTH", "token")) {
+    if (hfInvalid && sh.env.HF_TOKEN_PATH === this.kernel.path("cache", "HF_AUTH", "token")) {
       sh.env.HF_TOKEN_PATH = this.kernel.path("cache", "HF_AUTH", "anonymous")
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.2.22",
+  "version": "8.2.23",
   "description": "",
   "main": "index.js",
   "scripts": {

package/server/views/anywhere.ejs

@@ -133,7 +133,7 @@ document.addEventListener('DOMContentLoaded', function() {
     <header class='task-shell-header'>
       <div class='task-shell-header-main'>
         <h1 class='task-title'>Remote</h1>
-        <p class='task-description'>Open this Pinokio and its running apps from your phone or another computer, anywhere, over a private encrypted network.</p>
+        <p class='task-description'>Access this Pinokio and its running apps from another computer, phone, or tablet over a private encrypted network.</p>
       </div>
       <div class='task-header-actions'>
         <div class='anywhere-switch' id='anywhere-switch' data-on='false'>
@@ -147,7 +147,7 @@ document.addEventListener('DOMContentLoaded', function() {
         <div class='anywhere-state' data-state='off'>
           <div class='anywhere-card'>
             <h2>Remote access is off</h2>
-            <p>Turn it on to reach this computer from your phone. Nothing is exposed to the public internet: only devices signed in to your own Tailscale account can connect.</p>
+            <p>Turn it on to access this Pinokio from another device. Nothing is exposed to the public internet: only devices signed in to your own Tailscale account can connect.</p>
             <p><button class='anywhere-btn' data-action='start'><i class="fa-solid fa-power-off"></i> Turn on</button></p>
           </div>
         </div>
@@ -162,7 +162,7 @@ document.addEventListener('DOMContentLoaded', function() {
         <div class='anywhere-state' data-state='login'>
           <div class='anywhere-card'>
             <h2>Sign in in your browser</h2>
-            <p>Remote access uses <b>Tailscale</b>, a free private network. Sign in with a <b>personal</b> Google, Apple, GitHub or Microsoft account. You will use the same account on your phone.</p>
+            <p>Remote access uses <b>Tailscale</b>, a free private network. Sign in with a <b>personal</b> Google, Apple, GitHub or Microsoft account. Use the same account on every device you want to connect.</p>
             <p><a class='anywhere-btn' id='anywhere-login-link' href='#' target='_blank' rel='noopener'><i class="fa-solid fa-arrow-up-right-from-square"></i> Sign in with Tailscale</a></p>
             <p class='anywhere-muted'>Waiting for you to finish signing in… <span id='anywhere-login-url' class='anywhere-muted'></span></p>
           </div>
@@ -179,7 +179,7 @@ document.addEventListener('DOMContentLoaded', function() {
         <div class='anywhere-state' data-state='https'>
           <div class='anywhere-card'>
             <h2>One more click: enable HTTPS</h2>
-            <p id='anywhere-approval-text'>Tailscale needs your permission once to issue HTTPS certificates for your network. Apps need HTTPS for things like camera and microphone access on your phone.</p>
+            <p id='anywhere-approval-text'>Tailscale needs your permission once to issue HTTPS certificates for your network. Apps need HTTPS for things like camera and microphone access in your browser.</p>
             <p><a class='anywhere-btn' id='anywhere-approval-link' href='#' target='_blank' rel='noopener'><i class="fa-solid fa-lock"></i> Enable HTTPS</a>
                <a class='anywhere-btn secondary' href='https://login.tailscale.com/admin/dns' target='_blank' rel='noopener'>Open DNS settings</a></p>
             <p class='anywhere-muted'>Waiting for HTTPS to be enabled… (in the admin console: DNS → HTTPS Certificates → Enable)</p>
@@ -197,19 +197,20 @@ document.addEventListener('DOMContentLoaded', function() {
         <div class='anywhere-state' data-state='ready'>
           <div class='anywhere-grid'>
             <div class='anywhere-card'>
-              <h2>Connect your phone</h2>
+              <h2>Connect another device</h2>
               <div class='anywhere-qr'>
                 <img id='anywhere-qr' alt='QR code to connect' src=''>
                 <div class='anywhere-address'><a id='anywhere-address' href='#' target='_blank' rel='noopener'></a></div>
                 <div class='anywhere-muted'>signed in as <b id='anywhere-account'></b></div>
-                <div class='anywhere-waiting' id='anywhere-waiting'><i class="fa-solid fa-circle-notch fa-spin"></i> waiting for a phone to join…</div>
+                <div class='anywhere-waiting' id='anywhere-waiting'><i class="fa-solid fa-circle-notch fa-spin"></i> Waiting for another device to join…</div>
               </div>
               <h3>Steps</h3>
               <ol class='anywhere-steps'>
-                <li>Install the <b>Tailscale</b> app on your phone (App Store / Play Store).</li>
+                <li>Install <b>Tailscale</b> on the computer, phone, or tablet you want to connect from.</li>
                 <li>Sign in with <b class='anywhere-account-inline'></b> and turn the connection on.</li>
-                <li>Scan the QR code, or open the address above in your phone's browser. Use <i>Add to Home Screen</i> for an app-like icon.</li>
+                <li>On that device, scan the QR code or open the address above in a browser.</li>
               </ol>
+              <p class='anywhere-muted'>Bookmark the address for quick access. On a phone or tablet, you can also use <i>Add to Home Screen</i>.</p>
             </div>
             <div>
               <div class='anywhere-card'>
@@ -326,12 +327,13 @@ document.addEventListener('DOMContentLoaded', function() {
       document.getElementById('anywhere-account').textContent = email
       for (const el of document.querySelectorAll('.anywhere-account-inline')) el.textContent = email
       const waiting = document.getElementById('anywhere-waiting')
-      if (current.mobilePeerPresent) {
+      const peers = Array.isArray(current.peers) ? current.peers : []
+      if (peers.length > 0) {
         waiting.classList.add('joined')
-        waiting.innerHTML = `<i class="fa-solid fa-check"></i> phone ${current.mobilePeerOnline ? 'connected' : 'joined (currently offline)'}`
+        waiting.innerHTML = `<i class="fa-solid fa-check"></i> ${peers.some((peer) => peer.online) ? 'Another device is online' : 'No other devices are online'}`
       } else {
         waiting.classList.remove('joined')
-        waiting.innerHTML = `<i class="fa-solid fa-circle-notch fa-spin"></i> waiting for a phone to join…`
+        waiting.innerHTML = `<i class="fa-solid fa-circle-notch fa-spin"></i> Waiting for another device to join…`
       }
       const apps = Array.isArray(current.apps) ? current.apps : []
       document.getElementById('anywhere-apps').innerHTML = apps.length === 0
@@ -346,9 +348,8 @@ document.addEventListener('DOMContentLoaded', function() {
           </div>`).join('')
       const serve = Array.isArray(current.serve) ? current.serve : []
       document.getElementById('anywhere-ports').innerHTML = serve.length === 0 ? '—' : serve.map((entry) => `${esc(entry.name || (entry.port === 443 ? 'Pinokio' : ''))} <a class='remote' href='${esc(entry.url)}' target='_blank' rel='noopener'>${esc(entry.url)}</a> → ${esc(entry.target)}`).join('<br>')
-      const peers = Array.isArray(current.peers) ? current.peers : []
       document.getElementById('anywhere-peers').innerHTML = peers.length === 0
-        ? `<p class='anywhere-muted'>No other devices yet. Sign in to Tailscale on your phone with the same account.</p>`
+        ? `<p class='anywhere-muted'>No other devices yet. Sign in to Tailscale on another device with the same account.</p>`
         : peers.map((peer) => `
           <div class='anywhere-row'>
             <span class='anywhere-dot ${peer.online ? 'online' : ''}'></span>
@@ -368,7 +369,7 @@ document.addEventListener('DOMContentLoaded', function() {
   const poll = async () => {
     try {
       const response = await fetch('/anywhere/status', { cache: 'no-store' })
-      if (!response.ok) throw new Error(`Could not refresh Anywhere status (${response.status})`)
+      if (!response.ok) throw new Error(`Could not refresh Remote status (${response.status})`)
       render(await response.json())
     } catch (e) {
       render(Object.assign({}, current, { phase: 'error', error: e.message }))
@@ -405,7 +406,7 @@ document.addEventListener('DOMContentLoaded', function() {
       if (action === 'logout') {
         Swal.fire({
           title: 'Sign out of Tailscale?',
-          text: 'Your phone will no longer be able to reach this Pinokio until you sign in again.',
+          text: 'Your other devices will no longer be able to reach this Pinokio until you sign in again.',
           showCancelButton: true,
           confirmButtonText: 'Sign out'
         }).then((result) => { if (result.isConfirmed) act('logout') })

package/test/huggingface-token-validity.test.js

@@ -5,6 +5,7 @@ const path = require('node:path')
 const test = require('node:test')
 
 const HF = require('../kernel/api/hf')
+const Connect = require('../kernel/connect')
 const HuggingfaceConnect = require('../kernel/connect/providers/huggingface')
 const Shell = require('../kernel/shell')
 const Shells = require('../kernel/shells')
@@ -18,6 +19,31 @@ function createKernel(root) {
   }
 }
 
+const connectionFailures = [
+  { name: 'revoked token', invalid: true, stderr: 'Error: Invalid user token. The token stored is invalid.\n' },
+  { name: 'missing token', invalid: true, stderr: 'Error: Not logged in\r\n' },
+  { name: 'colored authentication error', invalid: true, stderr: '\x1b[31mError: Invalid user token.\x1b[0m\r\n' },
+  { name: 'unusable CLI path', invalid: false, code: 'ENOTDIR', syscall: 'spawn' },
+  { name: 'timeout', invalid: false, code: null, killed: true },
+  { name: 'timeout after authentication output', invalid: false, killed: true, stderr: 'Error: Invalid user token.\n' },
+  { name: 'network error', invalid: false, stderr: 'Error: Connection refused\n' },
+  { name: 'rate limit', invalid: false, stderr: "Error: You've hit the rate limit for the /whoami-v2 endpoint.\n" },
+  { name: 'server error', invalid: false, stderr: 'Error: 500 Server Error\n' },
+  { name: 'permission error', invalid: false, stderr: 'Error: 403 Forbidden\n' },
+  { name: 'missing CLI', invalid: false, code: 'ENOENT' },
+  { name: 'unrecognized CLI error', invalid: false, stderr: 'Error: Unexpected failure\n' },
+  { name: 'incidental authentication text', invalid: false, stderr: 'Warning: Previous output: Error: Invalid user token.\n' }
+]
+
+function connectionError(fixture, tokenPath) {
+  return Object.assign(new Error(fixture.name), {
+    code: 1,
+    stderr: '',
+    ...fixture,
+    tokenPath
+  })
+}
+
 test('hf.login does not accept an invalid saved token', async () => {
   const context = {
     parentPath: '/pinokio/api/test/login.js',
@@ -68,11 +94,123 @@ test('whoami updates only the managed shared token path', async () => {
 
   provider.runHf = async () => {
     const error = new Error('invalid token')
+    error.code = 1
+    error.stderr = 'Error: Invalid user token. The token stored is invalid.\n'
     error.tokenPath = tokenPath
     throw error
   }
   assert.equal(await provider.connected(), false)
   assert.equal(kernel.envs.HF_TOKEN_PATH, anonymousPath)
+
+  provider.runHf = async () => {
+    throw connectionError(connectionFailures[0], customContext.env.HF_TOKEN_PATH)
+  }
+  kernel.envs.HF_TOKEN_PATH = tokenPath
+  assert.equal(await provider.connected({}, customContext), false)
+  assert.equal(kernel.envs.HF_TOKEN_PATH, tokenPath)
+
+  provider.runHf = async () => ({ env: { HF_TOKEN_PATH: tokenPath } })
+  kernel.envs.HF_TOKEN_PATH = anonymousPath
+  assert.deepEqual(await provider.connected({ details: true }), { connected: true, invalid: false })
+  assert.equal(kernel.envs.HF_TOKEN_PATH, tokenPath)
+})
+
+test('only confirmed authentication failures change shared credential selection', async (t) => {
+  const root = path.join(os.tmpdir(), 'pinokio-hf-failure-states')
+  const tokenPath = path.join(root, 'cache', 'HF_AUTH', 'token')
+  const anonymousPath = path.join(root, 'cache', 'HF_AUTH', 'anonymous')
+  for (const fixture of connectionFailures) {
+    await t.test(fixture.name, async () => {
+      for (const initialPath of [tokenPath, anonymousPath]) {
+        const kernel = createKernel(root)
+        kernel.envs = { HF_TOKEN_PATH: initialPath }
+        const provider = new HuggingfaceConnect(kernel, {})
+        provider.runHf = async () => { throw connectionError(fixture, tokenPath) }
+
+        assert.deepEqual(await provider.connected({ details: true }), {
+          connected: false,
+          invalid: fixture.invalid
+        })
+        assert.equal(kernel.envs.HF_TOKEN_PATH, fixture.invalid ? anonymousPath : initialPath)
+        assert.equal(await provider.connected(), false)
+        assert.equal(kernel.envs.HF_TOKEN_PATH, fixture.invalid ? anonymousPath : initialPath)
+      }
+    })
+  }
+})
+
+test('startup propagates only confirmed shared authentication failures to app shells', async (t) => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-hf-startup-'))
+  const tokenPath = path.join(root, 'cache', 'HF_AUTH', 'token')
+  const anonymousPath = path.join(root, 'cache', 'HF_AUTH', 'anonymous')
+  await fs.writeFile(path.join(root, 'ENVIRONMENT'), 'TEST_FIXTURE=1\n')
+  await fs.mkdir(path.dirname(tokenPath), { recursive: true })
+  await fs.writeFile(tokenPath, 'synthetic-token')
+  await fs.writeFile(path.join(path.dirname(tokenPath), 'stored_tokens'), 'synthetic-refresh-state')
+  try {
+    for (const fixture of [{ name: 'valid token', connected: true }, ...connectionFailures]) {
+      await t.test(fixture.name, async () => {
+        const kernel = createKernel(root)
+        kernel.bin = { envs: () => ({}) }
+        kernel.bracketedPasteSupport = {}
+        kernel.which = () => null
+        kernel.connect = new Connect(kernel)
+        let checks = 0
+        kernel.connect.clients.huggingface.runHf = async () => {
+          checks++
+          if (fixture.connected) return { env: { HF_TOKEN_PATH: tokenPath } }
+          throw connectionError(fixture, tokenPath)
+        }
+        const shells = new Shells(kernel)
+        shells.ensureBracketedPasteSupport = async () => {}
+        await shells.init()
+        const expectedPath = fixture.invalid ? anonymousPath : tokenPath
+        assert.equal(kernel.envs.HF_TOKEN_PATH, expectedPath)
+        await shells.init()
+        assert.equal(checks, 1)
+        assert.equal(kernel.envs.HF_TOKEN_PATH, expectedPath)
+
+        const appShell = new Shell(kernel)
+        await appShell.init_env({ env: {} })
+        assert.equal(appShell.env.HF_TOKEN_PATH, expectedPath)
+        assert.equal(await fs.readFile(tokenPath, 'utf8'), 'synthetic-token')
+        assert.equal(await fs.readFile(path.join(path.dirname(tokenPath), 'stored_tokens'), 'utf8'), 'synthetic-refresh-state')
+      })
+    }
+  } finally {
+    await fs.rm(root, { recursive: true, force: true })
+  }
+})
+
+test('a broken CLI executable path does not disable saved credentials at startup', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-hf-cli-path-'))
+  const tokenPath = path.join(root, 'cache', 'HF_AUTH', 'token')
+  try {
+    await fs.writeFile(path.join(root, 'ENVIRONMENT'), 'TEST_FIXTURE=1\n')
+    await fs.mkdir(path.dirname(tokenPath), { recursive: true })
+    await fs.writeFile(tokenPath, 'synthetic-token')
+    const brokenCliParent = path.join(root, 'cli-parent')
+    await fs.writeFile(brokenCliParent, 'file instead of directory')
+    const kernel = createKernel(root)
+    kernel.bin = { envs: () => ({}) }
+    kernel.bracketedPasteSupport = {}
+    kernel.which = () => null
+    kernel.connect = new Connect(kernel)
+    const provider = kernel.connect.clients.huggingface
+    provider.hfPath = () => path.join(brokenCliParent, 'hf')
+    assert.deepEqual(await provider.connected({ details: true, timeout: 1000 }), {
+      connected: false,
+      invalid: false
+    })
+    const shells = new Shells(kernel)
+    shells.ensureBracketedPasteSupport = async () => {}
+    await shells.init()
+    assert.equal(kernel.envs.HF_TOKEN_PATH, tokenPath)
+    assert.equal(await fs.readFile(tokenPath, 'utf8'), 'synthetic-token')
+    assert.equal(await fs.readFile(brokenCliParent, 'utf8'), 'file instead of directory')
+  } finally {
+    await fs.rm(root, { recursive: true, force: true })
+  }
 })
 
 test('provider login ignores only Pinokio\'s inherited anonymous path', async () => {
@@ -108,9 +246,11 @@ test('invalid managed tokens are replaced once without overriding apps', async (
   kernel.bracketedPasteSupport = {}
   kernel.which = () => null
   kernel.connect = {
-    connected: async () => {
+    connected: async (provider, options) => {
+      assert.equal(provider, 'huggingface')
+      assert.deepEqual(options, { timeout: 5000, details: true })
       checks++
-      return false
+      return { connected: false, invalid: true }
     }
   }
   const shells = new Shells(kernel)

package/docs/SECURITY_TODO.md

@@ -1,126 +0,0 @@
-# Security TODO (deferred)
-
-Written 2026-10-28. These are security items deliberately left out of the
-current work, kept here so they can be revisited later.
-
-The common thread: Pinokio owns the environment, the process spawn, the
-network path, the secrets and the whole fleet of installed apps. Each item
-below is a control that only a launcher can apply to every app at once.
-
----
-
-## A. Foundation (fix before making any "safe" claim)
-
-### A1. Origin check on the WebSocket
-- Where: `server/socket.js` (`new WebSocket.Server({ server })`, no `verifyClient`;
-  `ws._origin` is recorded but never enforced).
-- Problem: any page that can open a WebSocket to the daemon can send
-  `{method:"shell.run"}`. HTTPS pages are stopped by mixed-content rules, and
-  Chrome 154 warns before public HTTP pages, but Pinokio's own app UIs run on
-  `http://localhost:<port>` and are exempt from both. An XSS bug in a Gradio
-  app or ComfyUI custom node becomes a shell command on the machine. With the
-  HTTPS/Caddy router on, `wss://pinokio.localhost` is reachable from HTTPS
-  pages too.
-- Fix: accept only Pinokio's own origins (the daemon UI, `*.localhost` router
-  hosts, the Anywhere Tailscale host), plus a per-session token for the UI.
-
-### A2. Network exposure of the daemon
-- Where: `server/index.js` (`server.listen(port)` with no host, so all
-  interfaces; `cors({origin:'*'})`; `express-session` secret is the literal
-  string `"secret"`; no auth middleware).
-- Fix: bind 127.0.0.1 unless LAN sharing or Anywhere is enabled; random
-  session secret.
-
-### A3. Static file routes serve the whole Pinokio home
-- Where: `server/index.js` mounts `express.static(kernel.homedir)` at `/asset`
-  and `/files` with `serveIndex(hidden: true)`.
-- Problem: `key.json`, every `ENVIRONMENT` file and `connect/*/auth.json` are
-  downloadable by anything that can reach the daemon.
-- Fix: deny-list secret files/dirs, or move secrets out of the home tree.
-
-### A4. Secrets hygiene
-- `kernel/key.js` `set()` logs `{ key, val, password }` to the console.
-- Secrets live in plaintext: `~/pinokio/ENVIRONMENT`, per-app `ENVIRONMENT`,
-  `key.json`, `cache/HF_AUTH/token`, `connect/<provider>/auth.json`.
-- A new app's ENVIRONMENT inherits every custom key from the system
-  ENVIRONMENT (`kernel/environment.js`, `ENV("app")`), so user secrets
-  propagate into every app.
-- Fix: stop the logging; OS keychain for storage; stop inheriting secrets into
-  app ENVIRONMENT by default.
-
-### A5. Unverified downloads and unpinned system clones
-- `Bin.download` (`kernel/bin/index.js`) does no hash check. Direct URL
-  downloads with no hash: cloudflared (`releases/latest`), Homebrew zip and VS
-  Build Tools from `cocktailpeanut/bin`, aria2, cmake, mingw, standalone
-  python. Only Miniforge and the pip seed wheel are SHA-256 verified.
-- `pinokiocomputer/proto`, `network`, `proxy_registry`, `python` are cloned
-  from GitHub HEAD, unpinned, and re-cloned on every version change.
-- Fix: hash table per download (as done for Miniforge); pin system repos to a
-  commit or tag.
-
-### A6. PyTorch safe unpickling is disabled globally
-- Where: `kernel/shell.js` sets `TORCH_FORCE_NO_WEIGHTS_ONLY_LOAD=1` for every
-  app shell.
-- Problem: turns off the `weights_only=True` default PyTorch has shipped since
-  2.6. Malicious pickle models (nullifAI, Feb 2025) are a known vector.
-- Fix: make it per-app opt-in with a visible warning badge instead of global.
-
----
-
-## B. Platform security features (the "install through Pinokio and you're safe" story)
-
-### B1. Security advisory feed + Security Center
-- A small signed JSON list of blocked package versions, maintained by Pinokio,
-  fetched periodically (the OneCRL idea, applied to AI apps).
-- Enforce through env Pinokio already controls in `Shell.init_env`:
-  `PIP_CONSTRAINT` and `UV_CONSTRAINT` (constraints file with
-  `pkg!=x.y.z` lines), `UV_EXCLUDE_NEWER`, and bluefairy shims for npm/bun.
-- Example it would have stopped: Ultralytics 8.3.41/42/45/46 (Dec 2024
-  cryptominer), which reached ComfyUI users via the Impact Pack.
-- Security Center page: audit every app env (pip version, certifi, blocked
-  packages), one-click repair, fleet-wide. No app can do this for other apps.
-
-### B2. Release-age cooldown on by default
-- bluefairy exists (`kernel/bin/bluefairy.js`) but `protection_enabled`
-  defaults to `false` (`server/lib/app_preferences.js`), only applies to
-  `shell.run` (forced `"off"` for `shell.start`, `kernel.exec`, `bin.exec`),
-  and shims only npm/bun/uv, not pip or conda.
-- pnpm 11 and Yarn 4.10 now ship a cooldown on by default. Turn it on
-  globally (24h-72h), extend to pip, let the advisory feed override.
-
-### B3. Credential brokering (apps never see real secrets)
-- Run a local credential-injecting proxy and point apps at it via
-  `HF_ENDPOINT`, `OPENAI_BASE_URL`, `ANTHROPIC_BASE_URL`, etc. The app gets a
-  per-app placeholder; Pinokio adds the real token on the way out.
-- Gives per-app usage visibility and instant revocation. A malicious custom
-  node has nothing to exfiltrate.
-- Simpler interim: issue fine-grained per-app HF tokens.
-
-### B4. Model file scanning
-- `kernel/vault/*` (Disk Saver) already walks and hashes every model file.
-  Add a picklescan/modelscan pass for `.ckpt`, `.pt`, `.pth`, `.bin` and
-  surface results per app. Pairs with A6.
-
-### B5. Per-app sandbox (phased)
-- Chokepoint: every app command goes through `pty.spawn` in `kernel/shell.js`
-  (`Shell.init_env` → `exec`). The `exec` API (`kernel/api/exec`) and `sudo`
-  path (`shell.js` ~610) bypass it and need the same wrapper.
-- Reference implementation: Anthropic sandbox-runtime (sandbox-exec on macOS,
-  bubblewrap on Linux, local proxy for a domain allowlist; Windows in
-  progress).
-- Phase 1, observe only: show which domains an app contacted and what it
-  wrote outside its folder. Breaks nothing, already a visible value-add.
-- Phase 2: enforce per-app network allowlists (huggingface.co, pypi.org,
-  github.com by default).
-- Phase 3: filesystem confinement to app folder + shared caches.
-- Windows is the hard platform; ship macOS/Linux first.
-
-### B6. Script execution boundary (longer term)
-- `kernel/loader.js` `requireJS()` loads every `pinokio.js` / `install.js` /
-  `start.js` with plain `require()` in the daemon process, and `pinokio.js`
-  runs when an app is merely listed (`api.meta`, menu rendering).
-- `Api.resolveMethod` (`kernel/api/index.js`) dispatches `kernel.*` methods,
-  `exec`, `fs.download`, `script.start` and `sudo` to scripts with the live
-  kernel object.
-- Options: isolate scripts (vm / worker), capability gate at `resolveMethod`,
-  stop executing `pinokio.js` on listing.