pinokiod 8.2.22 → 8.2.24

package/kernel/cert_env.js

@@ -1,6 +1,6 @@
 const fs = require('fs')
 const path = require('path')
-const { randomUUID } = require('crypto')
+const { randomUUID, createHash } = require('crypto')
 
 // The managed CA bundle: the conda-forge ca-certificates package inside Miniforge.
 // Every app's Python HTTPS traffic is pointed at this one file so a revoked root is
@@ -83,25 +83,39 @@ async function readManagedBundle(file) {
 async function repairPipVendoredBundle(prefix, bundleFile, platform = process.platform) {
   const managed = await readManagedBundle(bundleFile).catch(() => null)
   if (!managed) return []
+  const sha256 = data => createHash('sha256').update(data).digest('hex')
   const repaired = []
   for (const target of await pipVendoredBundles(prefix, platform)) {
     const stat = await fs.promises.stat(target).catch(() => null)
     if (stat && !stat.isFile()) continue
+    const current = stat ? await fs.promises.readFile(target).catch(() => null) : null
     if (!stat) {
       // No pip here: nothing to do. pip present but its bundle gone (the user deleted a file
       // Pinokio could not replace): write a fresh one, or pip fails on every network call.
       const certifiDir = await fs.promises.stat(path.dirname(target)).catch(() => null)
       if (!certifiDir || !certifiDir.isDirectory()) continue
-    } else if (stat.size === managed.length) {
-      const current = await fs.promises.readFile(target).catch(() => null)
-      if (current && current.equals(managed)) continue
+    } else if (current && current.equals(managed)) {
+      console.log(`[cert] pip's vendored CA bundle already current: ${target}`, JSON.stringify({
+        timestamp: new Date().toISOString(), size_bytes: current.length, sha256: sha256(current),
+      }))
+      continue
     }
     const temporary = path.join(path.dirname(target), `.cacert-${randomUUID()}.tmp`)
     try {
       await fs.promises.writeFile(temporary, managed, { mode: stat ? stat.mode & 0o777 : 0o644 })
       await fs.promises.rename(temporary, target)
+      console.log(`[cert] replaced pip's vendored CA bundle: ${target}`, JSON.stringify({
+        timestamp: new Date().toISOString(),
+        before_size_bytes: current ? current.length : stat ? stat.size : null,
+        after_size_bytes: managed.length,
+        before_sha256: current ? sha256(current) : null,
+        after_sha256: sha256(managed),
+      }))
       repaired.push(target)
     } catch (error) {
+      console.log(`[cert] could not replace pip's vendored CA bundle: ${target}`, JSON.stringify({
+        timestamp: new Date().toISOString(), error: error.message,
+      }))
       // The caller decides what a failed replacement means; it needs to know which file.
       error.target = target
       error.prefix = prefix

package/kernel/connect/providers/huggingface/index.js

@@ -253,12 +253,17 @@ class Huggingface {
       if (this.kernel.envs && result.env.HF_TOKEN_PATH === this.defaultTokenPath()) {
         this.kernel.envs.HF_TOKEN_PATH = result.env.HF_TOKEN_PATH
       }
-      return true
+      return options.details === true ? { connected: true, invalid: false } : true
     } catch (error) {
-      if (this.kernel.envs && error.tokenPath === this.defaultTokenPath()) {
+      // Match the pinned hf CLI's authentication errors, not arbitrary command failures.
+      const invalid = !error.killed && (
+        (error.code === 1 && /^Error: (?:Invalid user token\.[^\r\n]*|Not logged in)\r?$/m.test(stripAnsi(error.stderr))) ||
+        (typeof error.path === "string" && error.path === error.tokenPath && ["EISDIR", "ENOTDIR", "ENOTEMPTY"].includes(error.code))
+      )
+      if (invalid && this.kernel.envs && error.tokenPath === this.defaultTokenPath()) {
         this.kernel.envs.HF_TOKEN_PATH = this.kernel.path("cache", "HF_AUTH", "anonymous")
       }
-      return false
+      return options.details === true ? { connected: false, invalid } : false
     }
   }
   async profile() {

package/kernel/environment.js

@@ -623,8 +623,8 @@ const init_folders = async (homedir, kernel) => {
     let is_relative = val.startsWith("./")
     if (is_absolute || is_relative) {
 
-      // skip condarc and pipconfig => special case
-      if (["PIP_CONFIG_FILE", "CONDARC", "HF_TOKEN_PATH"].includes(key)) {
+      // skip values that name a file, not a folder: config files and CA bundles
+      if (["PIP_CONFIG_FILE", "CONDARC", "HF_TOKEN_PATH", "SSL_CERT_FILE", "REQUESTS_CA_BUNDLE", "CURL_CA_BUNDLE", "PIP_CERT"].includes(kernel.platform === "win32" ? key.toUpperCase() : key)) {
         continue
       }
       // it's a path

package/kernel/shell.js

@@ -979,9 +979,6 @@ class Shell {
       blocked.cause = error
       throw blocked
     }
-    for (const target of repaired) {
-      console.log(`[cert] replaced pip's vendored CA bundle: ${target}`)
-    }
     return repaired
   }
   build (params) {

package/kernel/shells.js

@@ -47,8 +47,8 @@ class Shells {
   }
 */
   async init() {
-    const hfDisconnected = !this.kernel.envs?.HF_TOKEN_PATH &&
-      !(await this.kernel.connect.connected("huggingface", { timeout: 5000 }))
+    const hfInvalid = !this.kernel.envs?.HF_TOKEN_PATH &&
+      (await this.kernel.connect.connected("huggingface", { timeout: 5000, details: true }))?.invalid === true
 
     // iterate through all the envs
     let sh = new Shell(this.kernel)
@@ -61,7 +61,7 @@ class Shells {
     await sh.init_env({
       env: this.kernel.bin.envs({}),
     })
-    if (hfDisconnected && sh.env.HF_TOKEN_PATH === this.kernel.path("cache", "HF_AUTH", "token")) {
+    if (hfInvalid && sh.env.HF_TOKEN_PATH === this.kernel.path("cache", "HF_AUTH", "token")) {
       sh.env.HF_TOKEN_PATH = this.kernel.path("cache", "HF_AUTH", "anonymous")
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.2.22",
+  "version": "8.2.24",
   "description": "",
   "main": "index.js",
   "scripts": {

package/server/views/anywhere.ejs

@@ -133,7 +133,7 @@ document.addEventListener('DOMContentLoaded', function() {
     <header class='task-shell-header'>
       <div class='task-shell-header-main'>
         <h1 class='task-title'>Remote</h1>
-        <p class='task-description'>Open this Pinokio and its running apps from your phone or another computer, anywhere, over a private encrypted network.</p>
+        <p class='task-description'>Access this Pinokio and its running apps from another computer, phone, or tablet over a private encrypted network.</p>
       </div>
       <div class='task-header-actions'>
         <div class='anywhere-switch' id='anywhere-switch' data-on='false'>
@@ -147,7 +147,7 @@ document.addEventListener('DOMContentLoaded', function() {
         <div class='anywhere-state' data-state='off'>
           <div class='anywhere-card'>
             <h2>Remote access is off</h2>
-            <p>Turn it on to reach this computer from your phone. Nothing is exposed to the public internet: only devices signed in to your own Tailscale account can connect.</p>
+            <p>Turn it on to access this Pinokio from another device. Nothing is exposed to the public internet: only devices signed in to your own Tailscale account can connect.</p>
             <p><button class='anywhere-btn' data-action='start'><i class="fa-solid fa-power-off"></i> Turn on</button></p>
           </div>
         </div>
@@ -162,7 +162,7 @@ document.addEventListener('DOMContentLoaded', function() {
         <div class='anywhere-state' data-state='login'>
           <div class='anywhere-card'>
             <h2>Sign in in your browser</h2>
-            <p>Remote access uses <b>Tailscale</b>, a free private network. Sign in with a <b>personal</b> Google, Apple, GitHub or Microsoft account. You will use the same account on your phone.</p>
+            <p>Remote access uses <b>Tailscale</b>, a free private network. Sign in with a <b>personal</b> Google, Apple, GitHub or Microsoft account. Use the same account on every device you want to connect.</p>
             <p><a class='anywhere-btn' id='anywhere-login-link' href='#' target='_blank' rel='noopener'><i class="fa-solid fa-arrow-up-right-from-square"></i> Sign in with Tailscale</a></p>
             <p class='anywhere-muted'>Waiting for you to finish signing in… <span id='anywhere-login-url' class='anywhere-muted'></span></p>
           </div>
@@ -179,7 +179,7 @@ document.addEventListener('DOMContentLoaded', function() {
         <div class='anywhere-state' data-state='https'>
           <div class='anywhere-card'>
             <h2>One more click: enable HTTPS</h2>
-            <p id='anywhere-approval-text'>Tailscale needs your permission once to issue HTTPS certificates for your network. Apps need HTTPS for things like camera and microphone access on your phone.</p>
+            <p id='anywhere-approval-text'>Tailscale needs your permission once to issue HTTPS certificates for your network. Apps need HTTPS for things like camera and microphone access in your browser.</p>
             <p><a class='anywhere-btn' id='anywhere-approval-link' href='#' target='_blank' rel='noopener'><i class="fa-solid fa-lock"></i> Enable HTTPS</a>
                <a class='anywhere-btn secondary' href='https://login.tailscale.com/admin/dns' target='_blank' rel='noopener'>Open DNS settings</a></p>
             <p class='anywhere-muted'>Waiting for HTTPS to be enabled… (in the admin console: DNS → HTTPS Certificates → Enable)</p>
@@ -197,19 +197,20 @@ document.addEventListener('DOMContentLoaded', function() {
         <div class='anywhere-state' data-state='ready'>
           <div class='anywhere-grid'>
             <div class='anywhere-card'>
-              <h2>Connect your phone</h2>
+              <h2>Connect another device</h2>
               <div class='anywhere-qr'>
                 <img id='anywhere-qr' alt='QR code to connect' src=''>
                 <div class='anywhere-address'><a id='anywhere-address' href='#' target='_blank' rel='noopener'></a></div>
                 <div class='anywhere-muted'>signed in as <b id='anywhere-account'></b></div>
-                <div class='anywhere-waiting' id='anywhere-waiting'><i class="fa-solid fa-circle-notch fa-spin"></i> waiting for a phone to join…</div>
+                <div class='anywhere-waiting' id='anywhere-waiting'><i class="fa-solid fa-circle-notch fa-spin"></i> Waiting for another device to join…</div>
               </div>
               <h3>Steps</h3>
               <ol class='anywhere-steps'>
-                <li>Install the <b>Tailscale</b> app on your phone (App Store / Play Store).</li>
+                <li>Install <b>Tailscale</b> on the computer, phone, or tablet you want to connect from.</li>
                 <li>Sign in with <b class='anywhere-account-inline'></b> and turn the connection on.</li>
-                <li>Scan the QR code, or open the address above in your phone's browser. Use <i>Add to Home Screen</i> for an app-like icon.</li>
+                <li>On that device, scan the QR code or open the address above in a browser.</li>
               </ol>
+              <p class='anywhere-muted'>Bookmark the address for quick access. On a phone or tablet, you can also use <i>Add to Home Screen</i>.</p>
             </div>
             <div>
               <div class='anywhere-card'>
@@ -326,12 +327,13 @@ document.addEventListener('DOMContentLoaded', function() {
       document.getElementById('anywhere-account').textContent = email
       for (const el of document.querySelectorAll('.anywhere-account-inline')) el.textContent = email
       const waiting = document.getElementById('anywhere-waiting')
-      if (current.mobilePeerPresent) {
+      const peers = Array.isArray(current.peers) ? current.peers : []
+      if (peers.length > 0) {
         waiting.classList.add('joined')
-        waiting.innerHTML = `<i class="fa-solid fa-check"></i> phone ${current.mobilePeerOnline ? 'connected' : 'joined (currently offline)'}`
+        waiting.innerHTML = `<i class="fa-solid fa-check"></i> ${peers.some((peer) => peer.online) ? 'Another device is online' : 'No other devices are online'}`
       } else {
         waiting.classList.remove('joined')
-        waiting.innerHTML = `<i class="fa-solid fa-circle-notch fa-spin"></i> waiting for a phone to join…`
+        waiting.innerHTML = `<i class="fa-solid fa-circle-notch fa-spin"></i> Waiting for another device to join…`
       }
       const apps = Array.isArray(current.apps) ? current.apps : []
       document.getElementById('anywhere-apps').innerHTML = apps.length === 0
@@ -346,9 +348,8 @@ document.addEventListener('DOMContentLoaded', function() {
           </div>`).join('')
       const serve = Array.isArray(current.serve) ? current.serve : []
       document.getElementById('anywhere-ports').innerHTML = serve.length === 0 ? '—' : serve.map((entry) => `${esc(entry.name || (entry.port === 443 ? 'Pinokio' : ''))} <a class='remote' href='${esc(entry.url)}' target='_blank' rel='noopener'>${esc(entry.url)}</a> → ${esc(entry.target)}`).join('<br>')
-      const peers = Array.isArray(current.peers) ? current.peers : []
       document.getElementById('anywhere-peers').innerHTML = peers.length === 0
-        ? `<p class='anywhere-muted'>No other devices yet. Sign in to Tailscale on your phone with the same account.</p>`
+        ? `<p class='anywhere-muted'>No other devices yet. Sign in to Tailscale on another device with the same account.</p>`
         : peers.map((peer) => `
           <div class='anywhere-row'>
             <span class='anywhere-dot ${peer.online ? 'online' : ''}'></span>
@@ -368,7 +369,7 @@ document.addEventListener('DOMContentLoaded', function() {
   const poll = async () => {
     try {
       const response = await fetch('/anywhere/status', { cache: 'no-store' })
-      if (!response.ok) throw new Error(`Could not refresh Anywhere status (${response.status})`)
+      if (!response.ok) throw new Error(`Could not refresh Remote status (${response.status})`)
       render(await response.json())
     } catch (e) {
       render(Object.assign({}, current, { phase: 'error', error: e.message }))
@@ -405,7 +406,7 @@ document.addEventListener('DOMContentLoaded', function() {
       if (action === 'logout') {
         Swal.fire({
           title: 'Sign out of Tailscale?',
-          text: 'Your phone will no longer be able to reach this Pinokio until you sign in again.',
+          text: 'Your other devices will no longer be able to reach this Pinokio until you sign in again.',
           showCancelButton: true,
           confirmButtonText: 'Sign out'
         }).then((result) => { if (result.isConfirmed) act('logout') })

package/test/cert-env.test.js

@@ -310,6 +310,62 @@ test('Shell.activate stops the step when the pip bundle cannot be replaced', { s
   await fs.chmod(certifiDir, 0o700)
 })
 
+test('init_folders never turns a certificate file path into a directory', async t => {
+  const Environment = require('../kernel/environment')
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'cert-env-folders-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }).catch(() => {}))
+  const app = path.join(root, 'api', 'demo.git')
+  await fs.mkdir(app, { recursive: true })
+  const lines = [
+    `SSL_CERT_FILE=${path.join(root, 'custom', 'ssl.pem')}`,
+    `REQUESTS_CA_BUNDLE=${path.join(root, 'custom', 'requests.pem')}`,
+    `CURL_CA_BUNDLE=${path.join(root, 'custom', 'curl.pem')}`,
+    `PIP_CERT=${path.join(root, 'custom', 'pip.pem')}`,
+    `HF_HOME=${path.join(root, 'custom', 'hf')}`,
+  ]
+  await fs.writeFile(path.join(app, 'ENVIRONMENT'), lines.join('\n') + '\n')
+
+  await Environment.init_folders(app, createKernel(root))
+
+  for (const name of ['ssl.pem', 'requests.pem', 'curl.pem', 'pip.pem']) {
+    assert.equal(await fs.stat(path.join(root, 'custom', name)).catch(() => null), null, `${name} must not be created as a folder`)
+  }
+  assert.ok((await fs.stat(path.join(root, 'custom', 'hf'))).isDirectory(), 'ordinary path values are still created as folders')
+})
+
+test('init_folders handles Windows certificate key casing without changing POSIX key semantics', async t => {
+  const Environment = require('../kernel/environment')
+  for (const platform of ['win32', 'linux']) {
+    for (const casing of ['upper', 'lower', 'mixed']) {
+      await t.test(`${platform} ${casing}`, async t => {
+        const root = await tempRoot(t, 'cert-env-case-')
+        const app = path.join(root, 'api', 'demo.git')
+        await fs.mkdir(app, { recursive: true })
+        const keys = ['SSL_CERT_FILE', 'REQUESTS_CA_BUNDLE', 'CURL_CA_BUNDLE', 'PIP_CERT']
+        const lines = keys.map((key, index) => {
+          if (casing === 'lower') key = key.toLowerCase()
+          if (casing === 'mixed') key = key[0] + key.slice(1).toLowerCase()
+          return `${key}=${path.join(root, 'custom', `${index}.pem`)}`
+        })
+        lines.push(`HF_HOME=${path.join(root, 'custom', 'hf')}`)
+        await fs.writeFile(path.join(app, 'ENVIRONMENT'), lines.join('\n') + '\n')
+        const kernel = createKernel(root)
+        kernel.platform = platform
+        await Environment.init_folders(app, kernel)
+        for (let index = 0; index < keys.length; index++) {
+          const stat = await fs.stat(path.join(root, 'custom', `${index}.pem`)).catch(() => null)
+          if (platform === 'win32' || casing === 'upper') {
+            assert.equal(stat, null, 'recognized certificate files must not become folders')
+          } else {
+            assert.ok(stat.isDirectory(), 'nonstandard POSIX keys retain ordinary folder handling')
+          }
+        }
+        assert.ok((await fs.stat(path.join(root, 'custom', 'hf'))).isDirectory())
+      })
+    }
+  }
+})
+
 function escapeForHtml(value) {
   return require('escape-html')(value)
 }

package/test/cert-repair-log.test.js

@@ -0,0 +1,97 @@
+const assert = require('node:assert/strict')
+const fs = require('node:fs/promises')
+const os = require('node:os')
+const path = require('node:path')
+const { createHash } = require('node:crypto')
+const test = require('node:test')
+const { repairPipVendoredBundle } = require('../kernel/cert_env')
+
+const sha256 = data => createHash('sha256').update(data).digest('hex')
+const MANAGED = 'new certificate bundle\n'
+const STALE = 'old certificate bundle\n' // Equal sizes must still produce different hashes.
+
+async function fixture(t, platform = 'linux') {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-cert-log-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  const prefix = path.join(root, 'env')
+  const site = platform === 'win32' ? 'Lib/site-packages' : 'lib/python3.10/site-packages'
+  const target = path.join(prefix, site, 'pip/_vendor/certifi/cacert.pem')
+  const managed = path.join(root, 'managed.pem')
+  await fs.mkdir(path.dirname(target), { recursive: true })
+  await fs.writeFile(target, STALE)
+  await fs.writeFile(managed, MANAGED)
+  const messages = []
+  t.mock.method(console, 'log', (...args) => messages.push(args))
+  return { root, prefix, target, managed, messages }
+}
+
+test('console logs contain independently verifiable evidence even for equal-size replacements', async t => {
+  for (const platform of ['linux', 'win32']) {
+    await t.test(platform, async t => {
+      const f = await fixture(t, platform)
+      assert.deepEqual(await repairPipVendoredBundle(f.prefix, f.managed, platform), [f.target])
+      assert.equal(f.messages.length, 1)
+      assert.ok(f.messages[0][0].includes(f.target))
+      const record = JSON.parse(f.messages[0][1])
+      assert.equal(record.before_size_bytes, Buffer.byteLength(STALE))
+      assert.equal(record.after_size_bytes, record.before_size_bytes)
+      assert.equal(record.before_sha256, sha256(STALE))
+      assert.equal(record.after_sha256, sha256(await fs.readFile(f.target)))
+      assert.notEqual(record.before_sha256, record.after_sha256)
+      assert.equal(new Date(record.timestamp).toISOString(), record.timestamp)
+      const mtime = (await fs.stat(f.target)).mtimeMs
+      assert.deepEqual(await repairPipVendoredBundle(f.prefix, f.managed, platform), [])
+      assert.equal((await fs.stat(f.target)).mtimeMs, mtime)
+      assert.ok(f.messages[1][0].includes('already current'))
+      assert.equal(JSON.parse(f.messages[1][1]).sha256, record.after_sha256)
+    })
+  }
+})
+
+test('a created PEM logs a missing baseline and the written size/hash', async t => {
+  const f = await fixture(t)
+  await fs.rm(f.target)
+  await repairPipVendoredBundle(f.prefix, f.managed, 'linux')
+  const record = JSON.parse(f.messages[0][1])
+  assert.equal(record.before_size_bytes, null)
+  assert.equal(record.before_sha256, null)
+  assert.equal(record.after_size_bytes, Buffer.byteLength(MANAGED))
+  assert.equal(record.after_sha256, sha256(MANAGED))
+})
+
+test('a failed rename logs failure and leaves the stale file and no temp file', async t => {
+  const f = await fixture(t)
+  t.mock.method(fs, 'rename', async () => { throw Object.assign(new Error('file locked'), { code: 'EPERM' }) })
+  await assert.rejects(repairPipVendoredBundle(f.prefix, f.managed, 'linux'), /file locked/)
+  assert.equal(f.messages.length, 1)
+  assert.equal(JSON.parse(f.messages[0][1]).error, 'file locked')
+  assert.equal(await fs.readFile(f.target, 'utf8'), STALE)
+  assert.deepEqual(await fs.readdir(path.dirname(f.target)), ['cacert.pem'])
+})
+
+test('logging a successful replacement adds no verification read or launch failure', async t => {
+  const f = await fixture(t)
+  const read = fs.readFile.bind(fs)
+  const rename = fs.rename.bind(fs)
+  let renamed = false
+  let reread = false
+  t.mock.method(fs, 'rename', async (...args) => {
+    await rename(...args)
+    renamed = true
+  })
+  t.mock.method(fs, 'readFile', async (file, ...args) => {
+    if (file === f.target && renamed) {
+      reread = true
+      throw Object.assign(new Error('reread denied'), { code: 'EACCES' })
+    }
+    return read(file, ...args)
+  })
+  assert.deepEqual(await repairPipVendoredBundle(f.prefix, f.managed, 'linux'), [f.target])
+  const record = JSON.parse(f.messages[0][1])
+  assert.equal(reread, false)
+  assert.equal(record.after_size_bytes, Buffer.byteLength(MANAGED))
+  assert.equal(record.after_sha256, sha256(MANAGED))
+  assert.equal(Object.hasOwn(record, 'verified'), false)
+  assert.equal(await read(f.target, 'utf8'), MANAGED)
+  assert.deepEqual(await fs.readdir(path.dirname(f.target)), ['cacert.pem'])
+})

package/test/huggingface-token-validity.test.js

@@ -5,6 +5,7 @@ const path = require('node:path')
 const test = require('node:test')
 
 const HF = require('../kernel/api/hf')
+const Connect = require('../kernel/connect')
 const HuggingfaceConnect = require('../kernel/connect/providers/huggingface')
 const Shell = require('../kernel/shell')
 const Shells = require('../kernel/shells')
@@ -18,6 +19,31 @@ function createKernel(root) {
   }
 }
 
+const connectionFailures = [
+  { name: 'revoked token', invalid: true, stderr: 'Error: Invalid user token. The token stored is invalid.\n' },
+  { name: 'missing token', invalid: true, stderr: 'Error: Not logged in\r\n' },
+  { name: 'colored authentication error', invalid: true, stderr: '\x1b[31mError: Invalid user token.\x1b[0m\r\n' },
+  { name: 'unusable CLI path', invalid: false, code: 'ENOTDIR', syscall: 'spawn' },
+  { name: 'timeout', invalid: false, code: null, killed: true },
+  { name: 'timeout after authentication output', invalid: false, killed: true, stderr: 'Error: Invalid user token.\n' },
+  { name: 'network error', invalid: false, stderr: 'Error: Connection refused\n' },
+  { name: 'rate limit', invalid: false, stderr: "Error: You've hit the rate limit for the /whoami-v2 endpoint.\n" },
+  { name: 'server error', invalid: false, stderr: 'Error: 500 Server Error\n' },
+  { name: 'permission error', invalid: false, stderr: 'Error: 403 Forbidden\n' },
+  { name: 'missing CLI', invalid: false, code: 'ENOENT' },
+  { name: 'unrecognized CLI error', invalid: false, stderr: 'Error: Unexpected failure\n' },
+  { name: 'incidental authentication text', invalid: false, stderr: 'Warning: Previous output: Error: Invalid user token.\n' }
+]
+
+function connectionError(fixture, tokenPath) {
+  return Object.assign(new Error(fixture.name), {
+    code: 1,
+    stderr: '',
+    ...fixture,
+    tokenPath
+  })
+}
+
 test('hf.login does not accept an invalid saved token', async () => {
   const context = {
     parentPath: '/pinokio/api/test/login.js',
@@ -68,11 +94,123 @@ test('whoami updates only the managed shared token path', async () => {
 
   provider.runHf = async () => {
     const error = new Error('invalid token')
+    error.code = 1
+    error.stderr = 'Error: Invalid user token. The token stored is invalid.\n'
     error.tokenPath = tokenPath
     throw error
   }
   assert.equal(await provider.connected(), false)
   assert.equal(kernel.envs.HF_TOKEN_PATH, anonymousPath)
+
+  provider.runHf = async () => {
+    throw connectionError(connectionFailures[0], customContext.env.HF_TOKEN_PATH)
+  }
+  kernel.envs.HF_TOKEN_PATH = tokenPath
+  assert.equal(await provider.connected({}, customContext), false)
+  assert.equal(kernel.envs.HF_TOKEN_PATH, tokenPath)
+
+  provider.runHf = async () => ({ env: { HF_TOKEN_PATH: tokenPath } })
+  kernel.envs.HF_TOKEN_PATH = anonymousPath
+  assert.deepEqual(await provider.connected({ details: true }), { connected: true, invalid: false })
+  assert.equal(kernel.envs.HF_TOKEN_PATH, tokenPath)
+})
+
+test('only confirmed authentication failures change shared credential selection', async (t) => {
+  const root = path.join(os.tmpdir(), 'pinokio-hf-failure-states')
+  const tokenPath = path.join(root, 'cache', 'HF_AUTH', 'token')
+  const anonymousPath = path.join(root, 'cache', 'HF_AUTH', 'anonymous')
+  for (const fixture of connectionFailures) {
+    await t.test(fixture.name, async () => {
+      for (const initialPath of [tokenPath, anonymousPath]) {
+        const kernel = createKernel(root)
+        kernel.envs = { HF_TOKEN_PATH: initialPath }
+        const provider = new HuggingfaceConnect(kernel, {})
+        provider.runHf = async () => { throw connectionError(fixture, tokenPath) }
+
+        assert.deepEqual(await provider.connected({ details: true }), {
+          connected: false,
+          invalid: fixture.invalid
+        })
+        assert.equal(kernel.envs.HF_TOKEN_PATH, fixture.invalid ? anonymousPath : initialPath)
+        assert.equal(await provider.connected(), false)
+        assert.equal(kernel.envs.HF_TOKEN_PATH, fixture.invalid ? anonymousPath : initialPath)
+      }
+    })
+  }
+})
+
+test('startup propagates only confirmed shared authentication failures to app shells', async (t) => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-hf-startup-'))
+  const tokenPath = path.join(root, 'cache', 'HF_AUTH', 'token')
+  const anonymousPath = path.join(root, 'cache', 'HF_AUTH', 'anonymous')
+  await fs.writeFile(path.join(root, 'ENVIRONMENT'), 'TEST_FIXTURE=1\n')
+  await fs.mkdir(path.dirname(tokenPath), { recursive: true })
+  await fs.writeFile(tokenPath, 'synthetic-token')
+  await fs.writeFile(path.join(path.dirname(tokenPath), 'stored_tokens'), 'synthetic-refresh-state')
+  try {
+    for (const fixture of [{ name: 'valid token', connected: true }, ...connectionFailures]) {
+      await t.test(fixture.name, async () => {
+        const kernel = createKernel(root)
+        kernel.bin = { envs: () => ({}) }
+        kernel.bracketedPasteSupport = {}
+        kernel.which = () => null
+        kernel.connect = new Connect(kernel)
+        let checks = 0
+        kernel.connect.clients.huggingface.runHf = async () => {
+          checks++
+          if (fixture.connected) return { env: { HF_TOKEN_PATH: tokenPath } }
+          throw connectionError(fixture, tokenPath)
+        }
+        const shells = new Shells(kernel)
+        shells.ensureBracketedPasteSupport = async () => {}
+        await shells.init()
+        const expectedPath = fixture.invalid ? anonymousPath : tokenPath
+        assert.equal(kernel.envs.HF_TOKEN_PATH, expectedPath)
+        await shells.init()
+        assert.equal(checks, 1)
+        assert.equal(kernel.envs.HF_TOKEN_PATH, expectedPath)
+
+        const appShell = new Shell(kernel)
+        await appShell.init_env({ env: {} })
+        assert.equal(appShell.env.HF_TOKEN_PATH, expectedPath)
+        assert.equal(await fs.readFile(tokenPath, 'utf8'), 'synthetic-token')
+        assert.equal(await fs.readFile(path.join(path.dirname(tokenPath), 'stored_tokens'), 'utf8'), 'synthetic-refresh-state')
+      })
+    }
+  } finally {
+    await fs.rm(root, { recursive: true, force: true })
+  }
+})
+
+test('a broken CLI executable path does not disable saved credentials at startup', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-hf-cli-path-'))
+  const tokenPath = path.join(root, 'cache', 'HF_AUTH', 'token')
+  try {
+    await fs.writeFile(path.join(root, 'ENVIRONMENT'), 'TEST_FIXTURE=1\n')
+    await fs.mkdir(path.dirname(tokenPath), { recursive: true })
+    await fs.writeFile(tokenPath, 'synthetic-token')
+    const brokenCliParent = path.join(root, 'cli-parent')
+    await fs.writeFile(brokenCliParent, 'file instead of directory')
+    const kernel = createKernel(root)
+    kernel.bin = { envs: () => ({}) }
+    kernel.bracketedPasteSupport = {}
+    kernel.which = () => null
+    kernel.connect = new Connect(kernel)
+    const provider = kernel.connect.clients.huggingface
+    provider.hfPath = () => path.join(brokenCliParent, 'hf')
+    assert.deepEqual(await provider.connected({ details: true, timeout: 1000 }), {
+      connected: false,
+      invalid: false
+    })
+    const shells = new Shells(kernel)
+    shells.ensureBracketedPasteSupport = async () => {}
+    await shells.init()
+    assert.equal(kernel.envs.HF_TOKEN_PATH, tokenPath)
+    assert.equal(await fs.readFile(tokenPath, 'utf8'), 'synthetic-token')
+    assert.equal(await fs.readFile(brokenCliParent, 'utf8'), 'file instead of directory')
+  } finally {
+    await fs.rm(root, { recursive: true, force: true })
+  }
 })
 
 test('provider login ignores only Pinokio\'s inherited anonymous path', async () => {
@@ -108,9 +246,11 @@ test('invalid managed tokens are replaced once without overriding apps', async (
   kernel.bracketedPasteSupport = {}
   kernel.which = () => null
   kernel.connect = {
-    connected: async () => {
+    connected: async (provider, options) => {
+      assert.equal(provider, 'huggingface')
+      assert.deepEqual(options, { timeout: 5000, details: true })
       checks++
-      return false
+      return { connected: false, invalid: true }
     }
   }
   const shells = new Shells(kernel)

package/docs/SECURITY_TODO.md

@@ -1,126 +0,0 @@
-# Security TODO (deferred)
-
-Written 2026-10-28. These are security items deliberately left out of the
-current work, kept here so they can be revisited later.
-
-The common thread: Pinokio owns the environment, the process spawn, the
-network path, the secrets and the whole fleet of installed apps. Each item
-below is a control that only a launcher can apply to every app at once.
-
----
-
-## A. Foundation (fix before making any "safe" claim)
-
-### A1. Origin check on the WebSocket
-- Where: `server/socket.js` (`new WebSocket.Server({ server })`, no `verifyClient`;
-  `ws._origin` is recorded but never enforced).
-- Problem: any page that can open a WebSocket to the daemon can send
-  `{method:"shell.run"}`. HTTPS pages are stopped by mixed-content rules, and
-  Chrome 154 warns before public HTTP pages, but Pinokio's own app UIs run on
-  `http://localhost:<port>` and are exempt from both. An XSS bug in a Gradio
-  app or ComfyUI custom node becomes a shell command on the machine. With the
-  HTTPS/Caddy router on, `wss://pinokio.localhost` is reachable from HTTPS
-  pages too.
-- Fix: accept only Pinokio's own origins (the daemon UI, `*.localhost` router
-  hosts, the Anywhere Tailscale host), plus a per-session token for the UI.
-
-### A2. Network exposure of the daemon
-- Where: `server/index.js` (`server.listen(port)` with no host, so all
-  interfaces; `cors({origin:'*'})`; `express-session` secret is the literal
-  string `"secret"`; no auth middleware).
-- Fix: bind 127.0.0.1 unless LAN sharing or Anywhere is enabled; random
-  session secret.
-
-### A3. Static file routes serve the whole Pinokio home
-- Where: `server/index.js` mounts `express.static(kernel.homedir)` at `/asset`
-  and `/files` with `serveIndex(hidden: true)`.
-- Problem: `key.json`, every `ENVIRONMENT` file and `connect/*/auth.json` are
-  downloadable by anything that can reach the daemon.
-- Fix: deny-list secret files/dirs, or move secrets out of the home tree.
-
-### A4. Secrets hygiene
-- `kernel/key.js` `set()` logs `{ key, val, password }` to the console.
-- Secrets live in plaintext: `~/pinokio/ENVIRONMENT`, per-app `ENVIRONMENT`,
-  `key.json`, `cache/HF_AUTH/token`, `connect/<provider>/auth.json`.
-- A new app's ENVIRONMENT inherits every custom key from the system
-  ENVIRONMENT (`kernel/environment.js`, `ENV("app")`), so user secrets
-  propagate into every app.
-- Fix: stop the logging; OS keychain for storage; stop inheriting secrets into
-  app ENVIRONMENT by default.
-
-### A5. Unverified downloads and unpinned system clones
-- `Bin.download` (`kernel/bin/index.js`) does no hash check. Direct URL
-  downloads with no hash: cloudflared (`releases/latest`), Homebrew zip and VS
-  Build Tools from `cocktailpeanut/bin`, aria2, cmake, mingw, standalone
-  python. Only Miniforge and the pip seed wheel are SHA-256 verified.
-- `pinokiocomputer/proto`, `network`, `proxy_registry`, `python` are cloned
-  from GitHub HEAD, unpinned, and re-cloned on every version change.
-- Fix: hash table per download (as done for Miniforge); pin system repos to a
-  commit or tag.
-
-### A6. PyTorch safe unpickling is disabled globally
-- Where: `kernel/shell.js` sets `TORCH_FORCE_NO_WEIGHTS_ONLY_LOAD=1` for every
-  app shell.
-- Problem: turns off the `weights_only=True` default PyTorch has shipped since
-  2.6. Malicious pickle models (nullifAI, Feb 2025) are a known vector.
-- Fix: make it per-app opt-in with a visible warning badge instead of global.
-
----
-
-## B. Platform security features (the "install through Pinokio and you're safe" story)
-
-### B1. Security advisory feed + Security Center
-- A small signed JSON list of blocked package versions, maintained by Pinokio,
-  fetched periodically (the OneCRL idea, applied to AI apps).
-- Enforce through env Pinokio already controls in `Shell.init_env`:
-  `PIP_CONSTRAINT` and `UV_CONSTRAINT` (constraints file with
-  `pkg!=x.y.z` lines), `UV_EXCLUDE_NEWER`, and bluefairy shims for npm/bun.
-- Example it would have stopped: Ultralytics 8.3.41/42/45/46 (Dec 2024
-  cryptominer), which reached ComfyUI users via the Impact Pack.
-- Security Center page: audit every app env (pip version, certifi, blocked
-  packages), one-click repair, fleet-wide. No app can do this for other apps.
-
-### B2. Release-age cooldown on by default
-- bluefairy exists (`kernel/bin/bluefairy.js`) but `protection_enabled`
-  defaults to `false` (`server/lib/app_preferences.js`), only applies to
-  `shell.run` (forced `"off"` for `shell.start`, `kernel.exec`, `bin.exec`),
-  and shims only npm/bun/uv, not pip or conda.
-- pnpm 11 and Yarn 4.10 now ship a cooldown on by default. Turn it on
-  globally (24h-72h), extend to pip, let the advisory feed override.
-
-### B3. Credential brokering (apps never see real secrets)
-- Run a local credential-injecting proxy and point apps at it via
-  `HF_ENDPOINT`, `OPENAI_BASE_URL`, `ANTHROPIC_BASE_URL`, etc. The app gets a
-  per-app placeholder; Pinokio adds the real token on the way out.
-- Gives per-app usage visibility and instant revocation. A malicious custom
-  node has nothing to exfiltrate.
-- Simpler interim: issue fine-grained per-app HF tokens.
-
-### B4. Model file scanning
-- `kernel/vault/*` (Disk Saver) already walks and hashes every model file.
-  Add a picklescan/modelscan pass for `.ckpt`, `.pt`, `.pth`, `.bin` and
-  surface results per app. Pairs with A6.
-
-### B5. Per-app sandbox (phased)
-- Chokepoint: every app command goes through `pty.spawn` in `kernel/shell.js`
-  (`Shell.init_env` → `exec`). The `exec` API (`kernel/api/exec`) and `sudo`
-  path (`shell.js` ~610) bypass it and need the same wrapper.
-- Reference implementation: Anthropic sandbox-runtime (sandbox-exec on macOS,
-  bubblewrap on Linux, local proxy for a domain allowlist; Windows in
-  progress).
-- Phase 1, observe only: show which domains an app contacted and what it
-  wrote outside its folder. Breaks nothing, already a visible value-add.
-- Phase 2: enforce per-app network allowlists (huggingface.co, pypi.org,
-  github.com by default).
-- Phase 3: filesystem confinement to app folder + shared caches.
-- Windows is the hard platform; ship macOS/Linux first.
-
-### B6. Script execution boundary (longer term)
-- `kernel/loader.js` `requireJS()` loads every `pinokio.js` / `install.js` /
-  `start.js` with plain `require()` in the daemon process, and `pinokio.js`
-  runs when an app is merely listed (`api.meta`, menu rendering).
-- `Api.resolveMethod` (`kernel/api/index.js`) dispatches `kernel.*` methods,
-  `exec`, `fs.download`, `script.start` and `sudo` to scripts with the live
-  kernel object.
-- Options: isolate scripts (vm / worker), capability gate at `resolveMethod`,
-  stop executing `pinokio.js` on listing.