pinokiod 8.2.5 → 8.2.7

package/kernel/anywhere/index.js

@@ -187,11 +187,8 @@ class Anywhere {
   async autostart() {
     // a pid file left behind by a crash or reboot must never point at an unrelated process
     if (!(await this.daemonAlive())) fs.rmSync(this.pidPath(), { force: true })
-    if (!(await this.installed())) {
-      await this.stop()
-      return false
-    }
     if (!(await this.enabled())) return false
+    if (!(await this.installed())) return false
     await this.start()
     return true
   }
@@ -202,11 +199,6 @@ class Anywhere {
   }
   async _start() {
     this.error = null
-    if (!(await this.installed())) {
-      await this.stop()
-      this.error = "Update the tailscaled tool before starting Pinokio Anywhere."
-      throw new Error(this.error)
-    }
     await this.loadConfig()
     await fs.promises.mkdir(this.stateDir(), { recursive: true })
     const bin = this.binPath()

package/kernel/bin/conda-pins.js

@@ -11,7 +11,7 @@ const TLS_PACKAGE_MINIMUMS = {
 // Bootstrap URL and hash: https://discuss.python.org/t/109576
 const PIP_MIN_VERSION = '26.2.2'
 const PIP_INSTALL_SPEC = 'pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70'
-const PIP_INSTALL_COMMAND = `python -I -m pip --isolated --disable-pip-version-check install --no-index --no-deps "${PIP_INSTALL_SPEC}"`
+const PIP_INSTALL_COMMAND = `python -I -m pip --isolated install --no-index "${PIP_INSTALL_SPEC}"`
 const TLS_PACKAGE_SPECS = Object.entries(TLS_PACKAGE_MINIMUMS).map(([name, version]) => `${name}>=${version}`)
 const hasSecureTlsPackages = (versions = {}) => Object.entries(TLS_PACKAGE_MINIMUMS).every(([name, minimum]) => {
   const version = semver.coerce(versions[name])
@@ -46,9 +46,7 @@ const isExpectedPythonPinned = (platform, version, build) => {
 
 module.exports = {
   CONDA_PIN_VERSION,
-  TLS_PACKAGE_MINIMUMS,
   PIP_MIN_VERSION,
-  PIP_INSTALL_SPEC,
   PIP_INSTALL_COMMAND,
   TLS_PACKAGE_SPECS,
   hasSecureTlsPackages,

package/kernel/bin/conda.js

@@ -9,7 +9,6 @@ const { buildCondaListFromMeta, managedCondaRuns, hasSecureManagedPip } = requir
 const {
   CONDA_PIN_VERSION,
   PIP_INSTALL_COMMAND,
-  TLS_PACKAGE_MINIMUMS,
   TLS_PACKAGE_SPECS,
   hasSecureTlsPackages,
   PYTHON_INSTALL_SPEC,
@@ -183,16 +182,14 @@ report_errors: false`)
       // Refresh a working runtime in place, preserving named app environments.
       await this.init()
       const bootstrap = await this.kernel.bin.exec({
-        message: [PIP_INSTALL_COMMAND, `python -I -m pip --isolated install --no-deps --only-binary=:all: --index-url https://pypi.org/simple "certifi>=${TLS_PACKAGE_MINIMUMS.certifi}"`],
+        message: PIP_INSTALL_COMMAND,
       }, ondata)
-      if (bootstrap?.error?.length) throw new Error("Conda certificate bootstrap failed; existing environments were preserved.")
+      if (bootstrap?.error?.length || !(await hasSecureManagedPip(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.platform))) throw new Error("Conda certificate bootstrap failed; existing environments were preserved.")
       const python = this.kernel.bin.path(CONDA_ROOT_DIR, this.kernel.platform === 'win32' ? 'python.exe' : 'bin/python')
-      const output = await new Promise((resolve, reject) => execFile(python,
-        ['-I', '-c', 'import certifi; from importlib.metadata import version; print(certifi.where()); print(version("certifi"))'],
+      const caFile = await new Promise((resolve, reject) => execFile(python,
+        ['-I', '-c', 'from pip._vendor import certifi; print(certifi.where())'],
         { env: managedPythonEnv(), windowsHide: true, timeout: 15000 },
         (error, stdout) => error ? reject(error) : resolve(stdout.trim())))
-      const [caFile, certifiVersion] = output.split(/[\r\n]+/)
-      if (!semver.valid(certifiVersion) || !semver.gte(certifiVersion, TLS_PACKAGE_MINIMUMS.certifi)) throw new Error("The certificate bootstrap did not complete.")
       const result = await this.kernel.bin.exec({
         message: [`conda install -y --override-channels -c conda-forge "${this.kernel.platform === "win32" ? WINDOWS_PYTHON_SSL_FIX_SPEC : PYTHON_INSTALL_SPEC}" "conda-libmamba-solver>=25.4.0" pip ${TLS_PACKAGE_SPECS.map(spec => `"${spec}"`).join(" ")}`, PIP_INSTALL_COMMAND],
         env: { CONDA_SSL_VERIFY: caFile },

package/kernel/bin/tailscaled.js

@@ -18,7 +18,6 @@ class Tailscaled {
     return this.kernel.bin.path("miniforge", "bin", "tailscaled")
   }
   async install(req, ondata) {
-    if (this.kernel.anywhere) await this.kernel.anywhere.stop()
     await this.kernel.bin.exec({
       message: [
         // a stale libmamba index cache reports the package as missing even

package/kernel/shell.js

@@ -21,7 +21,7 @@ const ShellParser = require('./shell_parser')
 const AnsiStreamTracker = require('./ansi_stream_tracker')
 const ShellStateSync = require('./shell_state_sync')
 const ShellRunTemplate = require('./api/shell_run_template')
-const { PYTHON_INSTALL_SPEC, PIP_INSTALL_COMMAND, PIP_MIN_VERSION } = require('./bin/conda-pins')
+const { PYTHON_INSTALL_SPEC, PIP_MIN_VERSION } = require('./bin/conda-pins')
 const CondaRuntimeGuard = require('./shell_conda_runtime_guard')
 const home = os.homedir()
 const WINDOWS_CMD_CONDA_COMMAND_PATTERN = /(?:^|[&|()]\s*)@?\s*(?:call\s+)?(?:"[^"]*[\\/]conda(?:\.bat|\.exe)?"|(?:[a-z]:)?[^&|()\s"]*[\\/]conda(?:\.bat|\.exe)?|conda(?:\.bat|\.exe)?)\s+/i
@@ -1399,16 +1399,13 @@ class Shell {
               deactivate_path,
 //              timeout,
               activate_command,
-              this.isPowerShell()
-                ? `${PIP_INSTALL_COMMAND}; if ($LASTEXITCODE -ne 0) { exit 1 }`
-                : `${PIP_INSTALL_COMMAND} || exit 1`,
 //              timeout,
             ]
           }
         }
         if (!use_uv) {
-          const checkPip = `python -I -c "from importlib.metadata import distributions; assert all(tuple(map(int, d.version.split('.')[:3])) >= (${PIP_MIN_VERSION.split(".").join(", ")}) for d in distributions(name='pip')), 'Update pip in this app environment before running it.'"`
-          venv_activation.push(this.isPowerShell() ? `${checkPip}; if ($LASTEXITCODE -ne 0) { exit 1 }` : `${checkPip} || exit 1`)
+          const updatePip = `uv pip install --exclude-newer-package pip=false "pip>=${PIP_MIN_VERSION}"`
+          venv_activation.push(this.isPowerShell() ? `${updatePip}; if ($LASTEXITCODE -ne 0) { exit 1 }` : `${updatePip} || exit 1`)
         }
       } else {
         venv_activation = []

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.2.5",
+  "version": "8.2.7",
   "description": "",
   "main": "index.js",
   "scripts": {

package/test/anywhere.test.js

@@ -441,18 +441,3 @@ test('sign-out resets the login state, and a link the server rejected is replace
     fs.rmSync(tmp, { recursive: true, force: true })
   }
 })
-
-
-test('old Tailscale daemons are stopped and cannot be adopted through direct start', async t => {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-version-'))
-  t.after(() => fs.rmSync(root, { recursive: true, force: true }))
-  const anywhere = new Anywhere(fakeKernel(root, { installed: false }))
-  let stopped = 0
-  anywhere.daemonAlive = async () => true
-  anywhere.enabled = async () => true
-  anywhere.stop = async () => { stopped++ }
-  assert.equal(await anywhere.autostart(), false)
-  assert.equal(stopped, 1)
-  await assert.rejects(anywhere.start(), /Update the tailscaled tool/)
-  assert.equal(stopped, 2)
-})

package/test/conda-bin.test.js

@@ -14,9 +14,7 @@ const {
   WINDOWS_PYTHON_SSL_FIX_SPEC,
   isExpectedCondaPinned,
   isExpectedPythonPinned,
-  TLS_PACKAGE_MINIMUMS,
   TLS_PACKAGE_SPECS,
-  PIP_INSTALL_SPEC,
   PIP_MIN_VERSION,
 } = require('../kernel/bin/conda-pins')
 
@@ -26,7 +24,8 @@ test.beforeEach(t => {
     if (args[0] !== '-I' || args[1] !== '-c') return realExecFile(binary, args, options, done)
     const prefix = path.basename(binary) === 'python.exe' ? path.dirname(binary) : path.dirname(path.dirname(binary))
     if (args[2].includes('certifi.where()')) {
-      done(null, path.join(prefix, 'certificates.pem') + '\n2026.10.19\n')
+      assert.match(args[2], /^from pip\._vendor import certifi;/)
+      done(null, path.join(prefix, 'certificates.pem') + '\n')
       return
     }
     fs.readFile(path.join(prefix, 'test-pip-version'), 'utf8').then(
@@ -73,8 +72,8 @@ async function writeHealthyCondaMeta(root, platform = 'win32', condaVersion = CO
   await writeCondaMeta(root, 'conda', condaVersion, 'py310')
   await writeCondaMeta(root, 'conda-libmamba-solver', '25.4.0', 'pyhd3eb1b0_0')
   await writeCondaMeta(root, 'python', '3.10.20', platform === 'win32' ? 'h4de0772_1_cpython' : 'cpython')
-  for (const [name, version] of Object.entries(TLS_PACKAGE_MINIMUMS)) {
-    await writeCondaMeta(root, name, version)
+  for (const name of ['ca-certificates', 'certifi']) {
+    await writeCondaMeta(root, name, '2026.10.19')
   }
   await fs.writeFile(path.join(root, 'bin/miniforge/test-pip-version'), PIP_MIN_VERSION)
 }
@@ -282,7 +281,7 @@ test('Conda install requests the Python 3.10.20 pin on macOS/Linux', async () =>
   assert.equal(await pathExists(path.join(root, 'bin', 'miniconda')), true)
   const condaInstall = calls.find((call) => Array.isArray(call.message))
   assert.ok(condaInstall)
-  assert.equal(condaInstall.message[2], `python -I -m pip --isolated --disable-pip-version-check install --no-index --no-deps "${PIP_INSTALL_SPEC}"`)
+  assert.match(condaInstall.message[2], /^python -I -m pip --isolated install --no-index "pip @ https:\/\/files\.pythonhosted\.org\/packages\/[a-f0-9/]+\/pip-26\.2\.2-py3-none-any\.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"$/)
   assert.equal(
     condaInstall.message[1],
     'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" pip "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
@@ -620,8 +619,8 @@ test('stale certificate packages trigger the existing Conda setup checks', async
   t.after(() => fs.rm(root, { recursive: true, force: true }))
   await writeHealthyCondaMeta(root, 'darwin')
   await writeFakeManagedConda(root, 'darwin')
-  for (const [name, version] of Object.entries(TLS_PACKAGE_MINIMUMS)) {
-    await fs.rm(path.join(root, 'bin/miniforge/conda-meta', `${name}-${version}.json`))
+  for (const name of ['ca-certificates', 'certifi']) {
+    await fs.rm(path.join(root, 'bin/miniforge/conda-meta', `${name}-2026.10.19.json`))
     await writeCondaMeta(root, name, '2026.4.22')
   }
   assert.equal(await createConda(createKernel(root, 'darwin')).check(), false)
@@ -655,7 +654,7 @@ test('old pip cannot pass Conda readiness even with current CA packages', async
   assert.equal(bin.correct_conda, false)
 })
 
-test('certificate refresh preserves named environments and uses the new CA bundle', async t => {
+test("certificate refresh preserves named environments and uses pip's bundled CA", async t => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-ca-refresh-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
   await writeHealthyCondaMeta(root, 'darwin')
@@ -670,6 +669,7 @@ test('certificate refresh preserves named environments and uses the new CA bundl
   await createConda(kernel).install({}, () => {})
   assert.equal(await fs.readFile(marker, 'utf8'), 'existing app')
   assert.equal(calls.length, 2)
+  assert.match(calls[0].message, /^python -I -m pip --isolated install --no-index /)
   assert.equal(calls[1].env.CONDA_SSL_VERIFY, path.join(root, 'bin/miniforge/certificates.pem'))
 })
 
@@ -679,9 +679,12 @@ test('failed pip bootstrap stops certificate refresh without replacing environme
   await writeHealthyCondaMeta(root, 'darwin')
   await writeFakeManagedConda(root, 'darwin')
   const kernel = createKernel(root, 'darwin')
-  kernel.bin.exec = async () => ({ error: ['ERROR: hash verification failed'] })
   kernel.bin.download = async () => assert.fail('must preserve the runtime')
-  await assert.rejects(createConda(kernel).install({}, () => {}), /bootstrap failed/)
+  await fs.writeFile(path.join(root, 'bin/miniforge/test-pip-version'), '26.2.1')
+  for (const response of [{ error: ['ERROR: hash verification failed'] }, {}]) {
+    kernel.bin.exec = async () => response
+    await assert.rejects(createConda(kernel).install({}, () => {}), /bootstrap failed/)
+  }
   assert.equal(await pathExists(path.join(root, 'bin/miniforge/conda-meta')), true)
 })
 

package/test/shell-run-template.test.js

@@ -3,9 +3,11 @@ const fs = require('node:fs/promises')
 const os = require('node:os')
 const path = require('node:path')
 const test = require('node:test')
+const { spawnSync } = require('node:child_process')
 
 const ShellRunTemplate = require('../kernel/api/shell_run_template')
 const Shell = require('../kernel/shell')
+const { PIP_MIN_VERSION } = require('../kernel/bin/conda-pins')
 
 function createKernel(root = process.cwd()) {
   return {
@@ -379,47 +381,86 @@ test('redactEnvArgs summarizes protected argv env values', () => {
 })
 
 
-test('new venv bootstrap failure prevents app commands even with chain:*', { skip: process.platform === 'win32' }, async t => {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-venv-bootstrap-'))
+test('venvs preserve creation behavior and enforce the pip minimum across shells', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-venv-selection-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
-  const kernel = createKernel(root)
-  kernel.bin = { path: (...parts) => path.join(root, 'bin', ...parts) }
-  const shell = createShell(kernel)
-  shell.shell = 'bash'
-  shell.env = {}
-  shell.conda_hook = () => ':'
-  const fakeBin = path.join(root, 'fake-bin')
-  await fs.mkdir(fakeBin)
-  await fs.writeFile(path.join(fakeBin, 'python'), '#!/bin/sh\nif [ "$1" = "-m" ]; then mkdir -p "$3/bin"; touch "$3/bin/activate"; exit 0; fi\nexit 19\n', { mode: 0o755 })
-  const params = await shell.activate({ path: root, conda: { skip: true }, venv: 'env', chain: '*', message: `touch '${root}/app-ran'` })
-  const result = require('node:child_process').spawnSync('bash', ['--noprofile', '--norc', '-c', shell.build(params)], { env: { ...process.env, PATH: fakeBin + ':' + process.env.PATH }, encoding: 'utf8' })
-  assert.notEqual(result.status, 0, result.stderr)
-  assert.equal(await fs.access(path.join(root, 'app-ran')).then(() => true, () => false), false)
-})
-
-test('existing app environments do not run the creation-only pip bootstrap', async t => {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-existing-env-'))
-  t.after(() => fs.rm(root, { recursive: true, force: true }))
-  await fs.mkdir(path.join(root, 'env'))
-  const shell = createShell(createKernel(root))
-  shell.shell = 'bash'
-  const params = await shell.activate({ path: root, conda: { skip: true }, venv: 'env', message: 'echo app' })
-  assert.doesNotMatch(shell.build(params), /pip.*install/)
+  const cases = [
+    { venv: 'default-env' },
+    { venv: { path: 'object-default-env' } },
+    { venv: 'explicit-env', venv_python: '3.10', version: '3.10' },
+    { venv: { path: 'object-env', python: '3.11' }, version: '3.11' },
+    { venv: 'existing-env', existing: true },
+    { venv: 'existing-env', venv_python: '3.10', version: '3.10', existing: true },
+    {},
+  ]
+  await fs.mkdir(path.join(root, 'existing-env'))
+  for (const [platform, shellName] of [
+    ['linux', 'bash'],
+    ['darwin', 'bash'],
+    ['win32', 'cmd.exe'],
+    ['win32', 'powershell'],
+    ['win32', 'bash'],
+  ]) {
+    for (const scenario of cases) {
+      const shell = createShell(createKernel(root))
+      shell.platform = platform
+      shell.shell = shellName
+      const params = await shell.activate({
+        path: root,
+        conda: { skip: true },
+        venv: scenario.venv,
+        venv_python: scenario.venv_python,
+        message: 'echo PINOKIO_REQUIREMENTS_RAN',
+      })
+      const command = shell.build(params)
+      assert.doesNotMatch(command, /--seed|--no-config|--python-preference|python -I|files\.pythonhosted\.org/)
+      assert.match(command, /echo PINOKIO_REQUIREMENTS_RAN$/)
+      if (!scenario.venv || scenario.existing) {
+        assert.doesNotMatch(command, /python -m venv|uv venv/)
+      } else if (scenario.version) {
+        assert.ok(command.includes(` --python ${scenario.version}`), command)
+        assert.doesNotMatch(command, /python -m venv/)
+      } else {
+        assert.match(command, /python -m venv /)
+      }
+      const updatePip = `uv pip install --exclude-newer-package pip=false "pip>=${PIP_MIN_VERSION}"`
+      if (scenario.venv && !scenario.version) {
+        assert.equal(command.split(updatePip).length - 1, 1)
+        assert.ok(command.indexOf(updatePip) > command.lastIndexOf('activate'))
+        assert.ok(command.includes(shell.isPowerShell()
+          ? `${updatePip}; if ($LASTEXITCODE -ne 0) { exit 1 }`
+          : `${updatePip} || exit 1`))
+      } else {
+        assert.doesNotMatch(command, /uv pip install/)
+      }
+      assert.equal(shell.env.UV_PYTHON_PREFERENCE, 'only-managed')
+    }
+  }
 })
 
 
-test('existing venv with outdated pip cannot bypass the guard on a retry', { skip: process.platform === 'win32' }, async t => {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-venv-retry-'))
+test('failed pip updates stop the application even with an unconditional command chain', async t => {
+  if (process.platform === 'win32') return t.skip('executes the POSIX shell failure guard')
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-pip-failure-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
-  await fs.mkdir(path.join(root, 'env/bin'), { recursive: true })
-  await fs.writeFile(path.join(root, 'env/bin/activate'), '')
-  const fakeBin = path.join(root, 'fake-bin')
-  await fs.mkdir(fakeBin)
-  await fs.writeFile(path.join(fakeBin, 'python'), '#!/bin/sh\nexit 19\n', { mode: 0o755 })
+  const binDir = path.join(root, 'bin')
+  await fs.mkdir(path.join(root, 'env', 'bin'), { recursive: true })
+  await fs.mkdir(binDir)
+  await fs.writeFile(path.join(root, 'env', 'bin', 'activate'), 'true\n')
+  await fs.writeFile(path.join(binDir, 'uv'), '#!/bin/sh\nexit "$PINOKIO_TEST_UV_EXIT_CODE"\n', { mode: 0o755 })
   const shell = createShell(createKernel(root))
   shell.shell = 'bash'
-  const params = await shell.activate({ path: root, conda: { skip: true }, venv: 'env', chain: '*', message: `touch '${root}/app-ran'` })
-  const result = require('node:child_process').spawnSync('bash', ['--noprofile', '--norc', '-c', shell.build(params)], { env: { ...process.env, PATH: fakeBin + ':' + process.env.PATH }, encoding: 'utf8' })
-  assert.notEqual(result.status, 0, result.stderr)
-  assert.equal(await fs.access(path.join(root, 'app-ran')).then(() => true, () => false), false)
+  const params = await shell.activate({
+    path: root, conda: { skip: true }, venv: 'env',
+    chain: '*', message: 'echo PINOKIO_APPLICATION_RAN',
+  })
+  const command = shell.build(params)
+  for (const exitCode of [0, 7]) {
+    const result = spawnSync('/bin/bash', ['-c', command], {
+      encoding: 'utf8',
+      env: { ...process.env, PATH: `${binDir}${path.delimiter}${process.env.PATH}`, PINOKIO_TEST_UV_EXIT_CODE: String(exitCode) },
+    })
+    assert.equal(result.status, exitCode ? 1 : 0, result.stderr)
+    assert.equal(result.stdout.includes('PINOKIO_APPLICATION_RAN'), exitCode === 0)
+  }
 })