pinokiod 8.2.7 → 8.2.8

package/kernel/bin/conda-meta.js

@@ -113,10 +113,10 @@ function resolveCondaBinary(minicondaPath, platform = process.platform, allowFal
 async function hasSecureManagedPip(prefix, platform = process.platform) {
   const python = path.join(prefix, platform === 'win32' ? 'python.exe' : 'bin/python')
   return await new Promise(resolve => {
-    execFile(python, ['-I', '-c', 'from importlib.metadata import version; print(version("pip"))'], {
+    execFile(python, ['-I', '-m', 'pip', '--version'], {
       env: managedPythonEnv(), windowsHide: true, timeout: 15000,
     }, (error, stdout) => {
-      const version = !error && semver.valid(String(stdout).trim())
+      const version = !error && semver.coerce(String(stdout).trim().match(/^pip\s+(\S+)/)?.[1] || '')
       resolve(!!version && semver.gte(version, PIP_MIN_VERSION))
     })
   })

package/kernel/bin/conda-pins.js

@@ -10,8 +10,7 @@ const TLS_PACKAGE_MINIMUMS = {
 // conda-forge's patched pip requires Python 3.11; this official wheel supports 3.10.
 // Bootstrap URL and hash: https://discuss.python.org/t/109576
 const PIP_MIN_VERSION = '26.2.2'
-const PIP_INSTALL_SPEC = 'pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70'
-const PIP_INSTALL_COMMAND = `python -I -m pip --isolated install --no-index "${PIP_INSTALL_SPEC}"`
+const PIP_INSTALL_COMMAND = 'python -I -m pip --isolated install --no-index "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"'
 const TLS_PACKAGE_SPECS = Object.entries(TLS_PACKAGE_MINIMUMS).map(([name, version]) => `${name}>=${version}`)
 const hasSecureTlsPackages = (versions = {}) => Object.entries(TLS_PACKAGE_MINIMUMS).every(([name, minimum]) => {
   const version = semver.coerce(versions[name])

package/kernel/bin/conda.js

@@ -2,8 +2,6 @@ const fs = require('fs')
 const { glob } = require('glob')
 const semver = require('semver')
 const { createHash } = require('crypto')
-const { execFile } = require('child_process')
-const { managedPythonEnv } = require('../python_env')
 const { isPathRemovalBlockedError, removePath } = require('../path_removal')
 const { buildCondaListFromMeta, managedCondaRuns, hasSecureManagedPip } = require('./conda-meta')
 const {
@@ -181,18 +179,11 @@ report_errors: false`)
         await managedCondaRuns(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.platform)) {
       // Refresh a working runtime in place, preserving named app environments.
       await this.init()
-      const bootstrap = await this.kernel.bin.exec({
-        message: PIP_INSTALL_COMMAND,
-      }, ondata)
-      if (bootstrap?.error?.length || !(await hasSecureManagedPip(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.platform))) throw new Error("Conda certificate bootstrap failed; existing environments were preserved.")
-      const python = this.kernel.bin.path(CONDA_ROOT_DIR, this.kernel.platform === 'win32' ? 'python.exe' : 'bin/python')
-      const caFile = await new Promise((resolve, reject) => execFile(python,
-        ['-I', '-c', 'from pip._vendor import certifi; print(certifi.where())'],
-        { env: managedPythonEnv(), windowsHide: true, timeout: 15000 },
-        (error, stdout) => error ? reject(error) : resolve(stdout.trim())))
       const result = await this.kernel.bin.exec({
-        message: [`conda install -y --override-channels -c conda-forge "${this.kernel.platform === "win32" ? WINDOWS_PYTHON_SSL_FIX_SPEC : PYTHON_INSTALL_SPEC}" "conda-libmamba-solver>=25.4.0" pip ${TLS_PACKAGE_SPECS.map(spec => `"${spec}"`).join(" ")}`, PIP_INSTALL_COMMAND],
-        env: { CONDA_SSL_VERIFY: caFile },
+        message: [
+          `conda install -y --override-channels -c conda-forge "${this.kernel.platform === "win32" ? WINDOWS_PYTHON_SSL_FIX_SPEC : PYTHON_INSTALL_SPEC}" "conda-libmamba-solver>=25.4.0" ${TLS_PACKAGE_SPECS.map(spec => `"${spec}"`).join(" ")}`,
+          PIP_INSTALL_COMMAND,
+        ],
       }, ondata)
       if (result?.error?.length || !(await this.check())) throw new Error("Conda certificate update failed; existing environments were preserved.")
       return
@@ -281,7 +272,6 @@ report_errors: false`)
       `"conda=${CONDA_PIN_VERSION}"`,
       this.kernel.platform === "win32" ? `"${WINDOWS_PYTHON_SSL_FIX_SPEC}"` : `"${PYTHON_INSTALL_SPEC}"`,
       `"conda-libmamba-solver>=25.4.0"`,
-      "pip",
       ...TLS_PACKAGE_SPECS.map(spec => `"${spec}"`),
     ]
 
@@ -290,7 +280,7 @@ report_errors: false`)
       `conda install -y --override-channels -c conda-forge ${condaPackages.join(" ")} ${mods}`.trim(),
       PIP_INSTALL_COMMAND,
     ]
-    const result = await this.kernel.bin.exec({
+    await this.kernel.bin.exec({
       message: cmds,
       env: {
         PIP_REQUIRE_VIRTUALENV: "false"
@@ -298,7 +288,6 @@ report_errors: false`)
     }, (stream) => {
       ondata(stream)
     })
-    if (result?.error?.length) throw new Error("Conda package or pip installation failed.")
     if (this.kernel.platform === "win32") {
       // copy python.exe to python3.exe so you can run with both python3 and python
       await fs.promises.copyFile(

package/kernel/shell.js

@@ -21,7 +21,7 @@ const ShellParser = require('./shell_parser')
 const AnsiStreamTracker = require('./ansi_stream_tracker')
 const ShellStateSync = require('./shell_state_sync')
 const ShellRunTemplate = require('./api/shell_run_template')
-const { PYTHON_INSTALL_SPEC, PIP_MIN_VERSION } = require('./bin/conda-pins')
+const { PYTHON_INSTALL_SPEC, PIP_INSTALL_COMMAND } = require('./bin/conda-pins')
 const CondaRuntimeGuard = require('./shell_conda_runtime_guard')
 const home = os.homedir()
 const WINDOWS_CMD_CONDA_COMMAND_PATTERN = /(?:^|[&|()]\s*)@?\s*(?:call\s+)?(?:"[^"]*[\\/]conda(?:\.bat|\.exe)?"|(?:[a-z]:)?[^&|()\s"]*[\\/]conda(?:\.bat|\.exe)?|conda(?:\.bat|\.exe)?)\s+/i
@@ -1393,20 +1393,17 @@ class Shell {
           } else {
             // when python version is not specified, use the default python -m venv
             venv_activation = [
-              `python -m venv ${shellEnvPath}`,
+              this.isPowerShell() ? `python -m venv ${shellEnvPath}; if ($LASTEXITCODE -ne 0) { exit 1 }` : `python -m venv ${shellEnvPath} || exit 1`,
               activate_command,
 //              `python -m pip install --upgrade pip setuptools wheel`,
               deactivate_path,
 //              timeout,
               activate_command,
 //              timeout,
+              this.isPowerShell() ? `${PIP_INSTALL_COMMAND}; if ($LASTEXITCODE -ne 0) { exit 1 }` : `${PIP_INSTALL_COMMAND} || exit 1`,
             ]
           }
         }
-        if (!use_uv) {
-          const updatePip = `uv pip install --exclude-newer-package pip=false "pip>=${PIP_MIN_VERSION}"`
-          venv_activation.push(this.isPowerShell() ? `${updatePip}; if ($LASTEXITCODE -ne 0) { exit 1 }` : `${updatePip} || exit 1`)
-        }
       } else {
         venv_activation = []
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.2.7",
+  "version": "8.2.8",
   "description": "",
   "main": "index.js",
   "scripts": {

package/test/conda-bin.test.js

@@ -16,20 +16,17 @@ const {
   isExpectedPythonPinned,
   TLS_PACKAGE_SPECS,
   PIP_MIN_VERSION,
+  PIP_INSTALL_COMMAND,
 } = require('../kernel/bin/conda-pins')
 
 test.beforeEach(t => {
   const realExecFile = childProcess.execFile.bind(childProcess)
   t.mock.method(childProcess, 'execFile', (binary, args, options, done) => {
-    if (args[0] !== '-I' || args[1] !== '-c') return realExecFile(binary, args, options, done)
+    if (args[0] !== '-I') return realExecFile(binary, args, options, done)
     const prefix = path.basename(binary) === 'python.exe' ? path.dirname(binary) : path.dirname(path.dirname(binary))
-    if (args[2].includes('certifi.where()')) {
-      assert.match(args[2], /^from pip\._vendor import certifi;/)
-      done(null, path.join(prefix, 'certificates.pem') + '\n')
-      return
-    }
+    assert.deepEqual(args, ['-I', '-m', 'pip', '--version'])
     fs.readFile(path.join(prefix, 'test-pip-version'), 'utf8').then(
-      version => done(null, version), error => done(error, '')
+      version => done(null, `pip ${version.trim()} from ${prefix} (python 3.10)`), error => done(error, '')
     )
   })
   for (const file of ['../kernel/bin/conda-meta', '../kernel/bin/conda', '../kernel/bin']) {
@@ -281,10 +278,10 @@ test('Conda install requests the Python 3.10.20 pin on macOS/Linux', async () =>
   assert.equal(await pathExists(path.join(root, 'bin', 'miniconda')), true)
   const condaInstall = calls.find((call) => Array.isArray(call.message))
   assert.ok(condaInstall)
-  assert.match(condaInstall.message[2], /^python -I -m pip --isolated install --no-index "pip @ https:\/\/files\.pythonhosted\.org\/packages\/[a-f0-9/]+\/pip-26\.2\.2-py3-none-any\.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"$/)
+  assert.equal(condaInstall.message[2], PIP_INSTALL_COMMAND)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" pip "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
+    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
   )
   assert.equal(
     await fs.readFile(path.join(root, 'bin', 'miniforge', 'conda-meta', 'pinned'), 'utf8'),
@@ -316,7 +313,7 @@ test('Conda install keeps the Windows Python 3.10.20 SSL-fixed build pin', async
   assert.ok(condaInstall)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20=*_1_cpython" "conda-libmamba-solver>=25.4.0" pip "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
+    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20=*_1_cpython" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
   )
 })
 
@@ -348,7 +345,7 @@ test('Conda install replaces the stale runtime and rebuilds declared Conda modul
   assert.ok(condaInstall)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" pip "ca-certificates>=2026.10.19" "certifi>=2026.10.19" uv=0.11.23 nodejs=22.21.1 pnpm'
+    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19" uv=0.11.23 nodejs=22.21.1 pnpm'
   )
 })
 
@@ -629,78 +626,131 @@ test('stale certificate packages trigger the existing Conda setup checks', async
   assert.equal(bin.correct_conda, false)
 })
 
-test('tampered Miniforge installers leave the existing runtime untouched', async t => {
+test('tampered Miniforge installers stop immediately and leave the runtime untouched', async t => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-hash-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
   await createMiniforge(root)
   const kernel = createKernel(root, 'darwin')
-  kernel.bin.download = async () => fs.writeFile(path.join(root, 'bin/installer.sh'), 'tampered')
+  let downloads = 0
+  kernel.bin.download = async () => {
+    downloads++
+    await fs.writeFile(path.join(root, 'bin/installer.sh'), 'tampered')
+  }
+  kernel.bin.mod = { caddy: { running: () => assert.fail('must verify before stopping services') } }
   const conda = new Conda()
   conda.kernel = kernel
-  await assert.rejects(conda._install({}, () => {}), /SHA-256 verification failed/)
+  await assert.rejects(conda.install({}, () => {}), /SHA-256 verification failed/)
+  assert.equal(downloads, 1)
   assert.equal(await pathExists(path.join(root, 'bin/miniforge/Scripts/conda.exe')), true)
 })
 
-
-test('old pip cannot pass Conda readiness even with current CA packages', async t => {
+test('old or missing pip cannot pass readiness even with current CA packages', async t => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-pip-ready-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
   await writeHealthyCondaMeta(root, 'darwin')
   await writeFakeManagedConda(root, 'darwin')
-  await fs.writeFile(path.join(root, 'bin/miniforge/test-pip-version'), '26.2.1')
-  assert.equal(await createConda(createKernel(root, 'darwin')).check(), false)
-  const bin = createBin(root, 'darwin')
-  await bin.tryList()
-  assert.equal(bin.correct_conda, false)
+  for (const version of ['26.2.1', null]) {
+    const pip = path.join(root, 'bin/miniforge/test-pip-version')
+    if (version) await fs.writeFile(pip, version)
+    else await fs.rm(pip)
+    assert.equal(await createConda(createKernel(root, 'darwin')).check(), false)
+    const bin = createBin(root, 'darwin')
+    await bin.tryList()
+    assert.equal(bin.correct_conda, false)
+  }
 })
 
-test("certificate refresh preserves named environments and uses pip's bundled CA", async t => {
+test('certificate refresh preserves named environments and existing configuration', async t => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-ca-refresh-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
-  await writeHealthyCondaMeta(root, 'darwin')
-  await writeFakeManagedConda(root, 'darwin')
-  const marker = path.join(root, 'bin/miniforge/envs/app/keep')
-  await fs.mkdir(path.dirname(marker), { recursive: true })
-  await fs.writeFile(marker, 'existing app')
-  const kernel = createKernel(root, 'darwin')
-  const calls = []
-  kernel.bin.download = async () => assert.fail('must not replace a working runtime')
-  kernel.bin.exec = async payload => { calls.push(payload); return {} }
-  await createConda(kernel).install({}, () => {})
-  assert.equal(await fs.readFile(marker, 'utf8'), 'existing app')
-  assert.equal(calls.length, 2)
-  assert.match(calls[0].message, /^python -I -m pip --isolated install --no-index /)
-  assert.equal(calls[1].env.CONDA_SSL_VERIFY, path.join(root, 'bin/miniforge/certificates.pem'))
+  for (const platform of ['win32', 'darwin', 'linux']) {
+    const dir = path.join(root, platform)
+    await writeHealthyCondaMeta(dir, platform)
+    await writeFakeManagedConda(dir, platform)
+    await fs.writeFile(path.join(dir, 'bin/miniforge/test-pip-version'), '23.0.1')
+    const marker = path.join(dir, 'bin/miniforge/envs/app/keep')
+    await fs.mkdir(path.dirname(marker), { recursive: true })
+    await fs.writeFile(marker, 'existing app')
+    const config = 'CONDA_SSL_VERIFY=private CA.pem\nPIP_CONFIG_FILE=pip.conf\n'
+    await fs.writeFile(path.join(dir, 'ENVIRONMENT'), config)
+    const kernel = createKernel(dir, platform)
+    const calls = []
+    kernel.bin.download = async () => assert.fail('must not replace a working runtime')
+    kernel.bin.exec = async payload => {
+      calls.push(payload)
+      await writeHealthyCondaMeta(dir, platform)
+      return {}
+    }
+    await createConda(kernel).install({}, () => {})
+    assert.equal(await fs.readFile(marker, 'utf8'), 'existing app')
+    assert.equal(await fs.readFile(path.join(dir, 'ENVIRONMENT'), 'utf8'), config)
+    assert.equal(calls.length, 1)
+    assert.equal(calls[0].env, undefined)
+    assert.equal(calls[0]['-env'], undefined)
+    const python = platform === 'win32' ? WINDOWS_PYTHON_SSL_FIX_SPEC : PYTHON_INSTALL_SPEC
+    assert.deepEqual(calls[0].message, [
+      `conda install -y --override-channels -c conda-forge "${python}" "conda-libmamba-solver>=25.4.0" ${TLS_PACKAGE_SPECS.map(spec => `"${spec}"`).join(' ')}`,
+      PIP_INSTALL_COMMAND,
+    ])
+  }
 })
 
-test('failed pip bootstrap stops certificate refresh without replacing environments', async t => {
+test('failed refresh reports an error without falling back to runtime replacement', async t => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-ca-failed-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
   await writeHealthyCondaMeta(root, 'darwin')
   await writeFakeManagedConda(root, 'darwin')
+  const marker = path.join(root, 'bin/miniforge/envs/app/keep')
+  await fs.mkdir(path.dirname(marker), { recursive: true })
+  await fs.writeFile(marker, 'preserve')
   const kernel = createKernel(root, 'darwin')
   kernel.bin.download = async () => assert.fail('must preserve the runtime')
-  await fs.writeFile(path.join(root, 'bin/miniforge/test-pip-version'), '26.2.1')
-  for (const response of [{ error: ['ERROR: hash verification failed'] }, {}]) {
+  for (const response of [{ error: ['ERROR: download failed'] }, {}]) {
+    await fs.rm(path.join(root, 'bin/miniforge/test-pip-version'), { force: true })
     kernel.bin.exec = async () => response
-    await assert.rejects(createConda(kernel).install({}, () => {}), /bootstrap failed/)
+    await assert.rejects(createConda(kernel).install({}, () => {}), /certificate update failed; existing environments were preserved/)
+    assert.equal(await fs.readFile(marker, 'utf8'), 'preserve')
   }
-  assert.equal(await pathExists(path.join(root, 'bin/miniforge/conda-meta')), true)
 })
 
-test('fresh installation does not report a failed pip bootstrap as finished', async t => {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-install-failed-'))
+test('fresh installation retains readiness-based retries after package or pip errors', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-install-retry-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
   await fs.mkdir(path.join(root, 'bin'), { recursive: true })
   const kernel = createKernel(root, 'darwin')
+  let attempts = 0
   kernel.bin.mods = []
-  kernel.bin.download = async () => {}
+  kernel.bin.download = async () => { attempts++ }
+  kernel.bin.rm = async () => {}
   kernel.bin.exec = async payload => {
     if (payload.conda?.skip) {
-      await fs.mkdir(path.join(root, 'bin/miniforge/conda-meta'), { recursive: true })
+      await writeHealthyCondaMeta(root, 'darwin')
+      await writeFakeManagedConda(root, 'darwin')
+      await fs.writeFile(path.join(root, 'bin/miniforge/test-pip-version'), '23.0.1')
       return {}
     }
-    return { error: ['ERROR: pip download failed'] }
+    assert.deepEqual(payload.env, { PIP_REQUIRE_VIRTUALENV: 'false' })
+    assert.equal(payload.message[2], PIP_INSTALL_COMMAND)
+    if (attempts === 1) return { error: ['ERROR: pip download failed'] }
+    await fs.writeFile(path.join(root, 'bin/miniforge/test-pip-version'), PIP_MIN_VERSION)
+    return {}
+  }
+  const conda = createConda(kernel)
+  await conda.install({}, () => {})
+  assert.equal(attempts, 2)
+  assert.equal(await conda.check(), true)
+})
+
+test('pip readiness accepts two-part release versions through the actual pip CLI', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-pip-release-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  await writeHealthyCondaMeta(root, 'darwin')
+  await writeFakeManagedConda(root, 'darwin')
+  for (const version of ['26.3', '27.0']) {
+    await fs.writeFile(path.join(root, 'bin/miniforge/test-pip-version'), version)
+    assert.equal(await createConda(createKernel(root, 'darwin')).check(), true)
+    const bin = createBin(root, 'darwin')
+    await bin.tryList()
+    assert.equal(bin.correct_conda, true)
   }
-  await assert.rejects(createConda(kernel)._install({}, () => {}), /pip installation failed/)
 })

package/test/shell-run-template.test.js

@@ -7,7 +7,7 @@ const { spawnSync } = require('node:child_process')
 
 const ShellRunTemplate = require('../kernel/api/shell_run_template')
 const Shell = require('../kernel/shell')
-const { PIP_MIN_VERSION } = require('../kernel/bin/conda-pins')
+const { PIP_INSTALL_COMMAND } = require('../kernel/bin/conda-pins')
 
 function createKernel(root = process.cwd()) {
   return {
@@ -381,7 +381,7 @@ test('redactEnvArgs summarizes protected argv env values', () => {
 })
 
 
-test('venvs preserve creation behavior and enforce the pip minimum across shells', async t => {
+test('only new default venvs bootstrap pip across supported shells', async t => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-venv-selection-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
   const cases = [
@@ -413,7 +413,7 @@ test('venvs preserve creation behavior and enforce the pip minimum across shells
         message: 'echo PINOKIO_REQUIREMENTS_RAN',
       })
       const command = shell.build(params)
-      assert.doesNotMatch(command, /--seed|--no-config|--python-preference|python -I|files\.pythonhosted\.org/)
+      assert.doesNotMatch(command, /--seed|--no-config|--python-preference|uv pip install/)
       assert.match(command, /echo PINOKIO_REQUIREMENTS_RAN$/)
       if (!scenario.venv || scenario.existing) {
         assert.doesNotMatch(command, /python -m venv|uv venv/)
@@ -423,15 +423,18 @@ test('venvs preserve creation behavior and enforce the pip minimum across shells
       } else {
         assert.match(command, /python -m venv /)
       }
-      const updatePip = `uv pip install --exclude-newer-package pip=false "pip>=${PIP_MIN_VERSION}"`
-      if (scenario.venv && !scenario.version) {
-        assert.equal(command.split(updatePip).length - 1, 1)
-        assert.ok(command.indexOf(updatePip) > command.lastIndexOf('activate'))
-        assert.ok(command.includes(shell.isPowerShell()
-          ? `${updatePip}; if ($LASTEXITCODE -ne 0) { exit 1 }`
-          : `${updatePip} || exit 1`))
+      if (scenario.venv && !scenario.version && !scenario.existing) {
+        assert.equal(command.split(PIP_INSTALL_COMMAND).length - 1, 1)
+        assert.ok(command.indexOf(PIP_INSTALL_COMMAND) > command.lastIndexOf('activate'))
+        const envPath = path.resolve(root, typeof scenario.venv === 'string' ? scenario.venv : scenario.venv.path)
+        const shellPath = platform === 'win32' && /bash/i.test(shellName) ? `"${require('../kernel/util').p2u(envPath)}"` : envPath
+        for (const step of [`python -m venv ${shellPath}`, PIP_INSTALL_COMMAND]) {
+          assert.ok(command.includes(shell.isPowerShell()
+            ? `${step}; if ($LASTEXITCODE -ne 0) { exit 1 }`
+            : `${step} || exit 1`))
+        }
       } else {
-        assert.doesNotMatch(command, /uv pip install/)
+        assert.doesNotMatch(command, /-m pip/)
       }
       assert.equal(shell.env.UV_PYTHON_PREFERENCE, 'only-managed')
     }
@@ -439,15 +442,22 @@ test('venvs preserve creation behavior and enforce the pip minimum across shells
 })
 
 
-test('failed pip updates stop the application even with an unconditional command chain', async t => {
+test('failed venv creation or pip bootstrap stops an unconditional command chain', async t => {
   if (process.platform === 'win32') return t.skip('executes the POSIX shell failure guard')
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-pip-failure-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
   const binDir = path.join(root, 'bin')
-  await fs.mkdir(path.join(root, 'env', 'bin'), { recursive: true })
   await fs.mkdir(binDir)
-  await fs.writeFile(path.join(root, 'env', 'bin', 'activate'), 'true\n')
-  await fs.writeFile(path.join(binDir, 'uv'), '#!/bin/sh\nexit "$PINOKIO_TEST_UV_EXIT_CODE"\n', { mode: 0o755 })
+  await fs.writeFile(path.join(binDir, 'python'), `#!/bin/sh
+if [ "$1" = "-m" ] && [ "$2" = "venv" ]; then
+  [ "$PINOKIO_TEST_VENV_EXIT_CODE" = "0" ] || exit "$PINOKIO_TEST_VENV_EXIT_CODE"
+  mkdir -p "$3/bin"
+  echo 'deactivate() { :; }' > "$3/bin/activate"
+else
+  echo PINOKIO_PIP_BOOTSTRAP_RAN
+  exit "$PINOKIO_TEST_PIP_EXIT_CODE"
+fi
+`, { mode: 0o755 })
   const shell = createShell(createKernel(root))
   shell.shell = 'bash'
   const params = await shell.activate({
@@ -455,12 +465,13 @@ test('failed pip updates stop the application even with an unconditional command
     chain: '*', message: 'echo PINOKIO_APPLICATION_RAN',
   })
   const command = shell.build(params)
-  for (const exitCode of [0, 7]) {
+  for (const [venvExit, pipExit] of [[9, 0], [0, 7], [0, 0]]) {
     const result = spawnSync('/bin/bash', ['-c', command], {
       encoding: 'utf8',
-      env: { ...process.env, PATH: `${binDir}${path.delimiter}${process.env.PATH}`, PINOKIO_TEST_UV_EXIT_CODE: String(exitCode) },
+      env: { ...process.env, PATH: `${binDir}${path.delimiter}${process.env.PATH}`, PINOKIO_TEST_VENV_EXIT_CODE: String(venvExit), PINOKIO_TEST_PIP_EXIT_CODE: String(pipExit) },
     })
-    assert.equal(result.status, exitCode ? 1 : 0, result.stderr)
-    assert.equal(result.stdout.includes('PINOKIO_APPLICATION_RAN'), exitCode === 0)
+    assert.equal(result.status, venvExit || pipExit ? 1 : 0, result.stderr)
+    assert.equal(result.stdout.includes('PINOKIO_APPLICATION_RAN'), venvExit === 0 && pipExit === 0)
+    assert.equal(result.stdout.includes('PINOKIO_PIP_BOOTSTRAP_RAN'), venvExit === 0)
   }
 })