pinokiod 8.2.7 → 8.2.9

package/kernel/bin/conda-meta.js

@@ -113,10 +113,10 @@ function resolveCondaBinary(minicondaPath, platform = process.platform, allowFal
 async function hasSecureManagedPip(prefix, platform = process.platform) {
   const python = path.join(prefix, platform === 'win32' ? 'python.exe' : 'bin/python')
   return await new Promise(resolve => {
-    execFile(python, ['-I', '-c', 'from importlib.metadata import version; print(version("pip"))'], {
+    execFile(python, ['-I', '-m', 'pip', '--version'], {
       env: managedPythonEnv(), windowsHide: true, timeout: 15000,
     }, (error, stdout) => {
-      const version = !error && semver.valid(String(stdout).trim())
+      const version = !error && semver.coerce(String(stdout).trim().match(/^pip\s+(\S+)/)?.[1] || '')
       resolve(!!version && semver.gte(version, PIP_MIN_VERSION))
     })
   })

package/kernel/bin/conda-pins.js

@@ -10,8 +10,7 @@ const TLS_PACKAGE_MINIMUMS = {
 // conda-forge's patched pip requires Python 3.11; this official wheel supports 3.10.
 // Bootstrap URL and hash: https://discuss.python.org/t/109576
 const PIP_MIN_VERSION = '26.2.2'
-const PIP_INSTALL_SPEC = 'pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70'
-const PIP_INSTALL_COMMAND = `python -I -m pip --isolated install --no-index "${PIP_INSTALL_SPEC}"`
+const PIP_INSTALL_COMMAND = 'python -I -m pip --isolated install --no-index "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"'
 const TLS_PACKAGE_SPECS = Object.entries(TLS_PACKAGE_MINIMUMS).map(([name, version]) => `${name}>=${version}`)
 const hasSecureTlsPackages = (versions = {}) => Object.entries(TLS_PACKAGE_MINIMUMS).every(([name, minimum]) => {
   const version = semver.coerce(versions[name])

package/kernel/bin/conda.js

@@ -2,8 +2,6 @@ const fs = require('fs')
 const { glob } = require('glob')
 const semver = require('semver')
 const { createHash } = require('crypto')
-const { execFile } = require('child_process')
-const { managedPythonEnv } = require('../python_env')
 const { isPathRemovalBlockedError, removePath } = require('../path_removal')
 const { buildCondaListFromMeta, managedCondaRuns, hasSecureManagedPip } = require('./conda-meta')
 const {
@@ -181,18 +179,11 @@ report_errors: false`)
         await managedCondaRuns(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.platform)) {
       // Refresh a working runtime in place, preserving named app environments.
       await this.init()
-      const bootstrap = await this.kernel.bin.exec({
-        message: PIP_INSTALL_COMMAND,
-      }, ondata)
-      if (bootstrap?.error?.length || !(await hasSecureManagedPip(this.kernel.bin.path(CONDA_ROOT_DIR), this.kernel.platform))) throw new Error("Conda certificate bootstrap failed; existing environments were preserved.")
-      const python = this.kernel.bin.path(CONDA_ROOT_DIR, this.kernel.platform === 'win32' ? 'python.exe' : 'bin/python')
-      const caFile = await new Promise((resolve, reject) => execFile(python,
-        ['-I', '-c', 'from pip._vendor import certifi; print(certifi.where())'],
-        { env: managedPythonEnv(), windowsHide: true, timeout: 15000 },
-        (error, stdout) => error ? reject(error) : resolve(stdout.trim())))
       const result = await this.kernel.bin.exec({
-        message: [`conda install -y --override-channels -c conda-forge "${this.kernel.platform === "win32" ? WINDOWS_PYTHON_SSL_FIX_SPEC : PYTHON_INSTALL_SPEC}" "conda-libmamba-solver>=25.4.0" pip ${TLS_PACKAGE_SPECS.map(spec => `"${spec}"`).join(" ")}`, PIP_INSTALL_COMMAND],
-        env: { CONDA_SSL_VERIFY: caFile },
+        message: [
+          `conda install -y --override-channels -c conda-forge "${this.kernel.platform === "win32" ? WINDOWS_PYTHON_SSL_FIX_SPEC : PYTHON_INSTALL_SPEC}" "conda-libmamba-solver>=25.4.0" ${TLS_PACKAGE_SPECS.map(spec => `"${spec}"`).join(" ")}`,
+          PIP_INSTALL_COMMAND,
+        ],
       }, ondata)
       if (result?.error?.length || !(await this.check())) throw new Error("Conda certificate update failed; existing environments were preserved.")
       return
@@ -281,7 +272,6 @@ report_errors: false`)
       `"conda=${CONDA_PIN_VERSION}"`,
       this.kernel.platform === "win32" ? `"${WINDOWS_PYTHON_SSL_FIX_SPEC}"` : `"${PYTHON_INSTALL_SPEC}"`,
       `"conda-libmamba-solver>=25.4.0"`,
-      "pip",
       ...TLS_PACKAGE_SPECS.map(spec => `"${spec}"`),
     ]
 
@@ -290,7 +280,7 @@ report_errors: false`)
       `conda install -y --override-channels -c conda-forge ${condaPackages.join(" ")} ${mods}`.trim(),
       PIP_INSTALL_COMMAND,
     ]
-    const result = await this.kernel.bin.exec({
+    await this.kernel.bin.exec({
       message: cmds,
       env: {
         PIP_REQUIRE_VIRTUALENV: "false"
@@ -298,7 +288,6 @@ report_errors: false`)
     }, (stream) => {
       ondata(stream)
     })
-    if (result?.error?.length) throw new Error("Conda package or pip installation failed.")
     if (this.kernel.platform === "win32") {
       // copy python.exe to python3.exe so you can run with both python3 and python
       await fs.promises.copyFile(

package/kernel/shell.js

@@ -21,7 +21,7 @@ const ShellParser = require('./shell_parser')
 const AnsiStreamTracker = require('./ansi_stream_tracker')
 const ShellStateSync = require('./shell_state_sync')
 const ShellRunTemplate = require('./api/shell_run_template')
-const { PYTHON_INSTALL_SPEC, PIP_MIN_VERSION } = require('./bin/conda-pins')
+const { PYTHON_INSTALL_SPEC, PIP_INSTALL_COMMAND } = require('./bin/conda-pins')
 const CondaRuntimeGuard = require('./shell_conda_runtime_guard')
 const home = os.homedir()
 const WINDOWS_CMD_CONDA_COMMAND_PATTERN = /(?:^|[&|()]\s*)@?\s*(?:call\s+)?(?:"[^"]*[\\/]conda(?:\.bat|\.exe)?"|(?:[a-z]:)?[^&|()\s"]*[\\/]conda(?:\.bat|\.exe)?|conda(?:\.bat|\.exe)?)\s+/i
@@ -1280,9 +1280,9 @@ class Shell {
           // calling vcvars, but vcvars rebuilds LIB and drops that entry.
           // Restore both the active Conda environment and managed CUDA import
           // libraries after all compiler activation scripts have completed.
-          // CALL's second expansion is required because these commands are
-          // joined on one cmd.exe line and must read LIB after vcvars updates it.
-          conda_activation.push(`CALL set "LIB=%%CONDA_PREFIX%%\\Library\\lib;%%CUDA_HOME%%\\lib;%%LIB%%"`)
+          // Escape the quotes and variable names for interactive cmd.exe so
+          // CALL expands the current values only after activation has finished.
+          conda_activation.push(`CALL set ^"LIB=%^CONDA_PREFIX%\\Library\\lib;%^CUDA_HOME%\\lib;%^LIB%^"`)
         } catch (e) {
           console.log('vc vars setup', e)
         }
@@ -1400,13 +1400,10 @@ class Shell {
 //              timeout,
               activate_command,
 //              timeout,
+              this.isPowerShell() ? `${PIP_INSTALL_COMMAND}; if ($LASTEXITCODE -ne 0) { exit 1 }` : `${PIP_INSTALL_COMMAND} || exit 1`,
             ]
           }
         }
-        if (!use_uv) {
-          const updatePip = `uv pip install --exclude-newer-package pip=false "pip>=${PIP_MIN_VERSION}"`
-          venv_activation.push(this.isPowerShell() ? `${updatePip}; if ($LASTEXITCODE -ne 0) { exit 1 }` : `${updatePip} || exit 1`)
-        }
       } else {
         venv_activation = []
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.2.7",
+  "version": "8.2.9",
   "description": "",
   "main": "index.js",
   "scripts": {

package/server/index.js

@@ -1043,12 +1043,17 @@ class Server {
     if (light) {
       return snap
     }
+    let entries = []
+    try {
+      entries = await this.kernel.api.listApps()
+    } catch (_) { }
+    snap.installed = entries.length
     snap.apps = []
     if (snap.phase === "ready") {
       const serveByLocalPort = new Map((snap.serve || []).map((entry) => [entry.local, entry]))
       let running = []
       try {
-        running = await this.collectHomeServerApps()
+        running = await this.collectHomeServerApps(entries)
       } catch (_) {
         running = []
       }
@@ -1056,6 +1061,7 @@ class Server {
         const port = this.portFromUrl(app.ready_url || app.url)
         const entry = port ? serveByLocalPort.get(port) : null
         snap.apps.push({
+          id: app.id,
           name: app.name,
           icon: app.icon,
           state: app.state,
@@ -1076,16 +1082,18 @@ class Server {
     }
     return snap
   }
-  async collectHomeServerApps() {
+  // `entries`: an app list from kernel.api.listApps() the caller already has
+  async collectHomeServerApps(entries = null) {
     const apps = []
     if (!this.kernel || !this.kernel.api || typeof this.kernel.api.listApps !== "function") {
       return apps
     }
-    let entries = []
-    try {
-      entries = await this.kernel.api.listApps()
-    } catch (_) {
-      entries = []
+    if (!Array.isArray(entries)) {
+      try {
+        entries = await this.kernel.api.listApps()
+      } catch (_) {
+        entries = []
+      }
     }
     for (const entry of entries) {
       const appId = entry && (entry.id || entry.name) ? String(entry.id || entry.name) : ""
@@ -14261,6 +14269,13 @@ class Server {
         agent: req.agent,
       })
     }))
+    // the phone-first launcher: running apps with their stable Tailscale addresses
+    this.app.get("/remote", ex(async (req, res) => {
+      res.render("remote", {
+        status: await this.composeAnywhereStatus(),
+        theme: this.theme,
+      })
+    }))
     this.app.get("/anywhere/status", ex(async (req, res) => {
       res.set("Cache-Control", "no-store")
       res.json(await this.composeAnywhereStatus({ light: req.query.light === "1" }))

package/server/public/anywhere.webmanifest

@@ -1 +1 @@
-{"name":"Pinokio","short_name":"Pinokio","start_url":"/","scope":"/","display":"standalone","background_color":"#ffffff","theme_color":"#000000","icons":[{"src":"/android-chrome-192x192.png","sizes":"192x192","type":"image/png"},{"src":"/android-chrome-512x512.png","sizes":"512x512","type":"image/png","purpose":"any maskable"},{"src":"/apple-touch-icon.png","sizes":"180x180","type":"image/png"}]}
+{"name":"Pinokio","short_name":"Pinokio","start_url":"/remote","scope":"/","display":"standalone","background_color":"#ffffff","theme_color":"#000000","icons":[{"src":"/android-chrome-192x192.png","sizes":"192x192","type":"image/png"},{"src":"/android-chrome-512x512.png","sizes":"512x512","type":"image/png","purpose":"any maskable"},{"src":"/apple-touch-icon.png","sizes":"180x180","type":"image/png"}]}

package/server/views/partials/home_server_popover.ejs

@@ -1,3 +1,4 @@
+<a class="btn2 home-server-popover__trigger" href="/remote" data-tippy-content="Launcher" title="Launcher" aria-label="Launcher"><i class="fa-solid fa-table-cells-large"></i></a>
 <div class="home-server-popover" data-home-server-popover data-home-server-status="loading">
   <button
     type="button"

package/server/views/remote.ejs

@@ -0,0 +1,97 @@
+<!doctype html>
+<html lang="en">
+<head>
+<title>Pinokio</title>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" />
+<base target="_top">
+<% if (locals.anywhere_host) { %>
+<link rel="manifest" href="/anywhere.webmanifest">
+<link rel="apple-touch-icon" href="/apple-touch-icon.png">
+<meta name="apple-mobile-web-app-capable" content="yes">
+<meta name="apple-mobile-web-app-title" content="Pinokio">
+<% } %>
+<link href="/css/fontawesome.min.css" rel="stylesheet">
+<link href="/css/solid.min.css" rel="stylesheet">
+<style>
+:root { --bg: #f6f5f1; --card: #fff; --text: #1a1a1a; --muted: #6b6a66; --line: #dcdad2; --accent: #1a1a1a; --on: #fff; }
+body.dark { --bg: #141414; --card: #1e1e1e; --text: #f1f1f1; --muted: #a8a69f; --line: #333; --accent: #f1f1f1; --on: #141414; }
+* { box-sizing: border-box; }
+body { margin: 0; background: var(--bg); color: var(--text); font: 16px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; -webkit-text-size-adjust: 100%; }
+main { max-width: 480px; margin: 0 auto; padding: 24px 16px 48px; }
+h1 { font-size: 22px; font-weight: 600; margin: 0 0 18px; }
+h2 { font-size: 12px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.05em; color: var(--muted); margin: 0 0 8px; }
+.card { display: flex; align-items: center; gap: 12px; background: var(--card); border: 1px solid var(--line); border-radius: 14px; padding: 12px; margin: 0 0 10px; }
+.card img { width: 44px; height: 44px; border-radius: 10px; object-fit: cover; background: var(--bg); flex: none; }
+.card .body { flex: 1; min-width: 0; }
+.card .name { font-weight: 600; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.card .sub { font-size: 13px; color: var(--muted); }
+.card .sub a { color: inherit; }
+.open { flex: none; padding: 10px 16px; border-radius: 10px; background: var(--accent); color: var(--on); font-weight: 600; text-decoration: none; }
+.state { flex: none; font-size: 13px; color: var(--muted); }
+.notice { text-align: center; padding: 28px 16px; color: var(--muted); }
+.notice strong { display: block; color: var(--text); font-size: 17px; margin-bottom: 4px; }
+.door { display: flex; align-items: center; gap: 12px; border-radius: 14px; padding: 14px; text-decoration: none; color: var(--text); margin-top: 14px; }
+.door.dashed { border: 1px dashed var(--muted); }
+.door.solid { background: var(--accent); color: var(--on); }
+.door .body { flex: 1; }
+.door .title { font-weight: 600; }
+.door .cap { font-size: 13px; opacity: 0.75; }
+.door i { font-size: 18px; }
+.full { display: block; text-align: center; margin-top: 18px; color: var(--muted); font-size: 14px; text-decoration: none; }
+.full i { margin-right: 6px; }
+[hidden] { display: none !important; }
+</style>
+</head>
+<body class="<%=theme%>">
+<main>
+  <h1>Pinokio</h1>
+  <section id="running" hidden>
+    <h2>Running now</h2>
+    <div id="cards"></div>
+  </section>
+  <div id="notice" class="notice" hidden><strong>Nothing is running</strong>Start an app on your computer and it shows up here.</div>
+  <a id="door" class="door" href="/home">
+    <i class="fa-solid fa-plus"></i>
+    <div class="body"><div class="title" id="door-title"></div><div class="cap" id="door-cap"></div></div>
+    <i class="fa-solid fa-chevron-right"></i>
+  </a>
+  <a class="full" href="/home"><i class="fa-solid fa-house"></i> Open full Pinokio</a>
+</main>
+<script>
+(() => {
+  let current = <%- JSON.stringify(status || {}).replace(/</g, '\\u003c') %>
+  const esc = (v) => String(v == null ? '' : v).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]))
+  const port = (url) => { try { return new URL(url).port } catch (_) { return '' } }
+  const render = (status) => {
+    current = status || {}
+    const apps = Array.isArray(current.apps) ? current.apps : []
+    document.getElementById('running').hidden = apps.length === 0
+    document.getElementById('notice').hidden = apps.length > 0
+    document.getElementById('cards').innerHTML = apps.map((app) => `
+      <div class="card">
+        <img src="${esc(app.icon || '/pinokio-black.png')}" alt="">
+        <div class="body">
+          <div class="name">${esc(app.name)}</div>
+          <div class="sub">${app.remote ? ':' + esc(port(app.remote)) + ' · ' : ''}<a href="/p/${encodeURIComponent(app.id || '')}">${app.remote ? 'manage' : 'terminal'}</a></div>
+        </div>
+        ${app.remote ? `<a class="open" href="${esc(app.remote)}">Open</a>` : `<span class="state">${esc(app.state || 'starting')}…</span>`}
+      </div>`).join('')
+    const door = document.getElementById('door')
+    door.className = 'door ' + (apps.length > 0 ? 'dashed' : 'solid')
+    document.getElementById('door-title').textContent = apps.length > 0 ? 'Start another app' : 'Start an app'
+    document.getElementById('door-cap').textContent = `${current.installed || 0} installed apps in Pinokio`
+  }
+  const poll = async () => {
+    try {
+      const response = await fetch('/anywhere/status', { cache: 'no-store' })
+      if (response.ok) render(await response.json())
+    } catch (_) { }
+    setTimeout(poll, 5000)
+  }
+  render(current)
+  setTimeout(poll, 5000)
+})()
+</script>
+</body>
+</html>

package/test/anywhere-remote.test.js

@@ -0,0 +1,48 @@
+const assert = require('node:assert/strict')
+const path = require('node:path')
+const test = require('node:test')
+const ejs = require('ejs')
+const Server = require('../server/index.js')
+
+const view = path.resolve(__dirname, '..', 'server', 'views', 'remote.ejs')
+
+// composeAnywhereStatus with its collaborators stubbed: the launcher needs the
+// installed count and each running app's id next to its remote address.
+test('anywhere status carries the installed count and each app id', async () => {
+  const fake = {
+    kernel: {
+      anywhere: {
+        snapshot: async () => ({ phase: 'ready', connectUrl: null, serve: [{ local: 7860, url: 'https://pinokio.tail1.ts.net:43000' }] }),
+      },
+      api: { listApps: async () => [{ id: 'comfy' }, { id: 'forge' }, { id: 'idle' }] },
+    },
+    collectHomeServerApps: async () => [
+      { id: 'comfy', name: 'ComfyUI', icon: '/c.png', ready_url: 'http://127.0.0.1:7860', state: 'ready' },
+      { id: 'forge', name: 'Forge', icon: '/f.png', ready_url: '', state: 'starting' },
+    ],
+    portFromUrl: Server.prototype.portFromUrl,
+  }
+  const status = await Server.prototype.composeAnywhereStatus.call(fake, {})
+  assert.equal(status.installed, 3)
+  assert.deepEqual(status.apps.map((a) => [a.id, a.remote]), [['comfy', 'https://pinokio.tail1.ts.net:43000'], ['forge', null]])
+  const light = await Server.prototype.composeAnywhereStatus.call(fake, { light: true })
+  assert.equal(light.installed, undefined, 'the light status is unchanged')
+})
+
+test('the launcher page renders the running apps and one door to the full interface', async () => {
+  const render = (status) => ejs.renderFile(view, { status, theme: 'light', locals: {} })
+
+  const none = await render({ installed: 12, apps: [] })
+  assert.match(none, /Nothing is running/)
+  assert.match(none, /href="\/home"/)
+  assert.match(none, /Open full Pinokio/)
+  assert.match(none, /"installed":12/)
+
+  const some = await render({ installed: 12, apps: [
+    { id: 'comfy', name: 'ComfyUI', icon: '/c.png', state: 'ready', remote: 'https://pinokio.tail1.ts.net:43000' },
+    { id: 'forge', name: 'Forge', icon: '/f.png', state: 'starting', remote: null },
+  ] })
+  assert.match(some, /"remote":"https:\/\/pinokio\.tail1\.ts\.net:43000"/)
+  assert.match(some, /"id":"forge"/)
+  assert.doesNotMatch(some, /<link rel="manifest"/, 'manifest tags only for the Tailscale host')
+})

package/test/conda-bin.test.js

@@ -16,20 +16,17 @@ const {
   isExpectedPythonPinned,
   TLS_PACKAGE_SPECS,
   PIP_MIN_VERSION,
+  PIP_INSTALL_COMMAND,
 } = require('../kernel/bin/conda-pins')
 
 test.beforeEach(t => {
   const realExecFile = childProcess.execFile.bind(childProcess)
   t.mock.method(childProcess, 'execFile', (binary, args, options, done) => {
-    if (args[0] !== '-I' || args[1] !== '-c') return realExecFile(binary, args, options, done)
+    if (args[0] !== '-I') return realExecFile(binary, args, options, done)
     const prefix = path.basename(binary) === 'python.exe' ? path.dirname(binary) : path.dirname(path.dirname(binary))
-    if (args[2].includes('certifi.where()')) {
-      assert.match(args[2], /^from pip\._vendor import certifi;/)
-      done(null, path.join(prefix, 'certificates.pem') + '\n')
-      return
-    }
+    assert.deepEqual(args, ['-I', '-m', 'pip', '--version'])
     fs.readFile(path.join(prefix, 'test-pip-version'), 'utf8').then(
-      version => done(null, version), error => done(error, '')
+      version => done(null, `pip ${version.trim()} from ${prefix} (python 3.10)`), error => done(error, '')
     )
   })
   for (const file of ['../kernel/bin/conda-meta', '../kernel/bin/conda', '../kernel/bin']) {
@@ -281,10 +278,10 @@ test('Conda install requests the Python 3.10.20 pin on macOS/Linux', async () =>
   assert.equal(await pathExists(path.join(root, 'bin', 'miniconda')), true)
   const condaInstall = calls.find((call) => Array.isArray(call.message))
   assert.ok(condaInstall)
-  assert.match(condaInstall.message[2], /^python -I -m pip --isolated install --no-index "pip @ https:\/\/files\.pythonhosted\.org\/packages\/[a-f0-9/]+\/pip-26\.2\.2-py3-none-any\.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"$/)
+  assert.equal(condaInstall.message[2], PIP_INSTALL_COMMAND)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" pip "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
+    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
   )
   assert.equal(
     await fs.readFile(path.join(root, 'bin', 'miniforge', 'conda-meta', 'pinned'), 'utf8'),
@@ -316,7 +313,7 @@ test('Conda install keeps the Windows Python 3.10.20 SSL-fixed build pin', async
   assert.ok(condaInstall)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20=*_1_cpython" "conda-libmamba-solver>=25.4.0" pip "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
+    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20=*_1_cpython" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19"'
   )
 })
 
@@ -348,7 +345,7 @@ test('Conda install replaces the stale runtime and rebuilds declared Conda modul
   assert.ok(condaInstall)
   assert.equal(
     condaInstall.message[1],
-    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" pip "ca-certificates>=2026.10.19" "certifi>=2026.10.19" uv=0.11.23 nodejs=22.21.1 pnpm'
+    'conda install -y --override-channels -c conda-forge "conda=26.5.3" "python=3.10.20" "conda-libmamba-solver>=25.4.0" "ca-certificates>=2026.10.19" "certifi>=2026.10.19" uv=0.11.23 nodejs=22.21.1 pnpm'
   )
 })
 
@@ -629,78 +626,131 @@ test('stale certificate packages trigger the existing Conda setup checks', async
   assert.equal(bin.correct_conda, false)
 })
 
-test('tampered Miniforge installers leave the existing runtime untouched', async t => {
+test('tampered Miniforge installers stop immediately and leave the runtime untouched', async t => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-hash-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
   await createMiniforge(root)
   const kernel = createKernel(root, 'darwin')
-  kernel.bin.download = async () => fs.writeFile(path.join(root, 'bin/installer.sh'), 'tampered')
+  let downloads = 0
+  kernel.bin.download = async () => {
+    downloads++
+    await fs.writeFile(path.join(root, 'bin/installer.sh'), 'tampered')
+  }
+  kernel.bin.mod = { caddy: { running: () => assert.fail('must verify before stopping services') } }
   const conda = new Conda()
   conda.kernel = kernel
-  await assert.rejects(conda._install({}, () => {}), /SHA-256 verification failed/)
+  await assert.rejects(conda.install({}, () => {}), /SHA-256 verification failed/)
+  assert.equal(downloads, 1)
   assert.equal(await pathExists(path.join(root, 'bin/miniforge/Scripts/conda.exe')), true)
 })
 
-
-test('old pip cannot pass Conda readiness even with current CA packages', async t => {
+test('old or missing pip cannot pass readiness even with current CA packages', async t => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-pip-ready-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
   await writeHealthyCondaMeta(root, 'darwin')
   await writeFakeManagedConda(root, 'darwin')
-  await fs.writeFile(path.join(root, 'bin/miniforge/test-pip-version'), '26.2.1')
-  assert.equal(await createConda(createKernel(root, 'darwin')).check(), false)
-  const bin = createBin(root, 'darwin')
-  await bin.tryList()
-  assert.equal(bin.correct_conda, false)
+  for (const version of ['26.2.1', null]) {
+    const pip = path.join(root, 'bin/miniforge/test-pip-version')
+    if (version) await fs.writeFile(pip, version)
+    else await fs.rm(pip)
+    assert.equal(await createConda(createKernel(root, 'darwin')).check(), false)
+    const bin = createBin(root, 'darwin')
+    await bin.tryList()
+    assert.equal(bin.correct_conda, false)
+  }
 })
 
-test("certificate refresh preserves named environments and uses pip's bundled CA", async t => {
+test('certificate refresh preserves named environments and existing configuration', async t => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-ca-refresh-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
-  await writeHealthyCondaMeta(root, 'darwin')
-  await writeFakeManagedConda(root, 'darwin')
-  const marker = path.join(root, 'bin/miniforge/envs/app/keep')
-  await fs.mkdir(path.dirname(marker), { recursive: true })
-  await fs.writeFile(marker, 'existing app')
-  const kernel = createKernel(root, 'darwin')
-  const calls = []
-  kernel.bin.download = async () => assert.fail('must not replace a working runtime')
-  kernel.bin.exec = async payload => { calls.push(payload); return {} }
-  await createConda(kernel).install({}, () => {})
-  assert.equal(await fs.readFile(marker, 'utf8'), 'existing app')
-  assert.equal(calls.length, 2)
-  assert.match(calls[0].message, /^python -I -m pip --isolated install --no-index /)
-  assert.equal(calls[1].env.CONDA_SSL_VERIFY, path.join(root, 'bin/miniforge/certificates.pem'))
+  for (const platform of ['win32', 'darwin', 'linux']) {
+    const dir = path.join(root, platform)
+    await writeHealthyCondaMeta(dir, platform)
+    await writeFakeManagedConda(dir, platform)
+    await fs.writeFile(path.join(dir, 'bin/miniforge/test-pip-version'), '23.0.1')
+    const marker = path.join(dir, 'bin/miniforge/envs/app/keep')
+    await fs.mkdir(path.dirname(marker), { recursive: true })
+    await fs.writeFile(marker, 'existing app')
+    const config = 'CONDA_SSL_VERIFY=private CA.pem\nPIP_CONFIG_FILE=pip.conf\n'
+    await fs.writeFile(path.join(dir, 'ENVIRONMENT'), config)
+    const kernel = createKernel(dir, platform)
+    const calls = []
+    kernel.bin.download = async () => assert.fail('must not replace a working runtime')
+    kernel.bin.exec = async payload => {
+      calls.push(payload)
+      await writeHealthyCondaMeta(dir, platform)
+      return {}
+    }
+    await createConda(kernel).install({}, () => {})
+    assert.equal(await fs.readFile(marker, 'utf8'), 'existing app')
+    assert.equal(await fs.readFile(path.join(dir, 'ENVIRONMENT'), 'utf8'), config)
+    assert.equal(calls.length, 1)
+    assert.equal(calls[0].env, undefined)
+    assert.equal(calls[0]['-env'], undefined)
+    const python = platform === 'win32' ? WINDOWS_PYTHON_SSL_FIX_SPEC : PYTHON_INSTALL_SPEC
+    assert.deepEqual(calls[0].message, [
+      `conda install -y --override-channels -c conda-forge "${python}" "conda-libmamba-solver>=25.4.0" ${TLS_PACKAGE_SPECS.map(spec => `"${spec}"`).join(' ')}`,
+      PIP_INSTALL_COMMAND,
+    ])
+  }
 })
 
-test('failed pip bootstrap stops certificate refresh without replacing environments', async t => {
+test('failed refresh reports an error without falling back to runtime replacement', async t => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-ca-failed-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
   await writeHealthyCondaMeta(root, 'darwin')
   await writeFakeManagedConda(root, 'darwin')
+  const marker = path.join(root, 'bin/miniforge/envs/app/keep')
+  await fs.mkdir(path.dirname(marker), { recursive: true })
+  await fs.writeFile(marker, 'preserve')
   const kernel = createKernel(root, 'darwin')
   kernel.bin.download = async () => assert.fail('must preserve the runtime')
-  await fs.writeFile(path.join(root, 'bin/miniforge/test-pip-version'), '26.2.1')
-  for (const response of [{ error: ['ERROR: hash verification failed'] }, {}]) {
+  for (const response of [{ error: ['ERROR: download failed'] }, {}]) {
+    await fs.rm(path.join(root, 'bin/miniforge/test-pip-version'), { force: true })
     kernel.bin.exec = async () => response
-    await assert.rejects(createConda(kernel).install({}, () => {}), /bootstrap failed/)
+    await assert.rejects(createConda(kernel).install({}, () => {}), /certificate update failed; existing environments were preserved/)
+    assert.equal(await fs.readFile(marker, 'utf8'), 'preserve')
   }
-  assert.equal(await pathExists(path.join(root, 'bin/miniforge/conda-meta')), true)
 })
 
-test('fresh installation does not report a failed pip bootstrap as finished', async t => {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-install-failed-'))
+test('fresh installation retains readiness-based retries after package or pip errors', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-install-retry-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
   await fs.mkdir(path.join(root, 'bin'), { recursive: true })
   const kernel = createKernel(root, 'darwin')
+  let attempts = 0
   kernel.bin.mods = []
-  kernel.bin.download = async () => {}
+  kernel.bin.download = async () => { attempts++ }
+  kernel.bin.rm = async () => {}
   kernel.bin.exec = async payload => {
     if (payload.conda?.skip) {
-      await fs.mkdir(path.join(root, 'bin/miniforge/conda-meta'), { recursive: true })
+      await writeHealthyCondaMeta(root, 'darwin')
+      await writeFakeManagedConda(root, 'darwin')
+      await fs.writeFile(path.join(root, 'bin/miniforge/test-pip-version'), '23.0.1')
       return {}
     }
-    return { error: ['ERROR: pip download failed'] }
+    assert.deepEqual(payload.env, { PIP_REQUIRE_VIRTUALENV: 'false' })
+    assert.equal(payload.message[2], PIP_INSTALL_COMMAND)
+    if (attempts === 1) return { error: ['ERROR: pip download failed'] }
+    await fs.writeFile(path.join(root, 'bin/miniforge/test-pip-version'), PIP_MIN_VERSION)
+    return {}
+  }
+  const conda = createConda(kernel)
+  await conda.install({}, () => {})
+  assert.equal(attempts, 2)
+  assert.equal(await conda.check(), true)
+})
+
+test('pip readiness accepts two-part release versions through the actual pip CLI', async t => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-pip-release-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  await writeHealthyCondaMeta(root, 'darwin')
+  await writeFakeManagedConda(root, 'darwin')
+  for (const version of ['26.3', '27.0']) {
+    await fs.writeFile(path.join(root, 'bin/miniforge/test-pip-version'), version)
+    assert.equal(await createConda(createKernel(root, 'darwin')).check(), true)
+    const bin = createBin(root, 'darwin')
+    await bin.tryList()
+    assert.equal(bin.correct_conda, true)
   }
-  await assert.rejects(createConda(kernel)._install({}, () => {}), /pip installation failed/)
 })

package/test/shell-run-template.test.js

@@ -7,7 +7,7 @@ const { spawnSync } = require('node:child_process')
 
 const ShellRunTemplate = require('../kernel/api/shell_run_template')
 const Shell = require('../kernel/shell')
-const { PIP_MIN_VERSION } = require('../kernel/bin/conda-pins')
+const { PIP_INSTALL_COMMAND } = require('../kernel/bin/conda-pins')
 
 function createKernel(root = process.cwd()) {
   return {
@@ -183,8 +183,8 @@ test('Shell.activate restores Conda and CUDA library paths after Windows compile
   const compilerScript = path.join(activateRoot, 'vs2019_compiler_vars.bat')
   const cudaScript = path.join(activateRoot, '~cuda-nvcc_activate.bat')
   await fs.mkdir(activateRoot, { recursive: true })
-  await fs.writeFile(compilerScript, '@echo off\n')
-  await fs.writeFile(cudaScript, '@echo off\n')
+  await fs.writeFile(compilerScript, '@set "CONDA_PREFIX=C:\\active conda"\r\n@set "LIB=C:\\Visual Studio (x86)\\lib"\r\n')
+  await fs.writeFile(cudaScript, '@set "CUDA_HOME=C:\\active cuda"\r\n')
 
   const kernel = createKernel(root)
   kernel.bin = {
@@ -199,6 +199,7 @@ test('Shell.activate restores Conda and CUDA library paths after Windows compile
 
   const params = await shell.activate({
     build: true,
+    conda: { skip: true },
     path: root,
     message: ['uv pip install cupy'],
   })
@@ -206,7 +207,7 @@ test('Shell.activate restores Conda and CUDA library paths after Windows compile
   const activation = params.message[0]
   const compilerIndex = activation.indexOf(`CALL "${compilerScript}"`)
   const cudaIndex = activation.indexOf(`CALL "${cudaScript}"`)
-  const libraryCommand = 'CALL set "LIB=%%CONDA_PREFIX%%\\Library\\lib;%%CUDA_HOME%%\\lib;%%LIB%%"'
+  const libraryCommand = 'CALL set ^"LIB=%^CONDA_PREFIX%\\Library\\lib;%^CUDA_HOME%\\lib;%^LIB%^"'
   const libraryIndex = activation.indexOf(libraryCommand)
 
   assert.notEqual(compilerIndex, -1)
@@ -215,6 +216,23 @@ test('Shell.activate restores Conda and CUDA library paths after Windows compile
   assert.ok(compilerIndex < cudaIndex)
   assert.ok(cudaIndex < libraryIndex)
   assert.equal(params.message[1], 'uv pip install cupy')
+
+  await t.test('reads activated values in interactive cmd.exe', {
+    skip: process.platform !== 'win32' && 'requires Windows cmd.exe',
+  }, () => {
+    for (const mode of ['OFF', 'ON']) {
+      const result = spawnSync('cmd.exe', ['/D', '/Q', `/V:${mode}`], {
+        env: { ...process.env, CONDA_PREFIX: 'stale-conda', CUDA_HOME: 'stale-cuda', LIB: 'stale-lib' },
+        input: `${activation} & echo. & set LIB\r\nexit\r\n`,
+        encoding: 'utf8',
+        timeout: 10000,
+        windowsHide: true,
+      })
+      assert.ifError(result.error)
+      assert.equal(result.status, 0, result.stdout + result.stderr)
+      assert.match(result.stdout, /^LIB=C:\\active conda\\Library\\lib;C:\\active cuda\\lib;C:\\Visual Studio \(x86\)\\lib\r?$/m)
+    }
+  })
 })
 
 test('Shell.init_env defaults the uv HTTP timeout without overriding apps', async () => {
@@ -381,11 +399,11 @@ test('redactEnvArgs summarizes protected argv env values', () => {
 })
 
 
-test('venvs preserve creation behavior and enforce the pip minimum across shells', async t => {
+test('only new default venvs bootstrap pip across supported shells', async t => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-venv-selection-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
   const cases = [
-    { venv: 'default-env' },
+    { venv: "default env $NAME O'Brien (test)" },
     { venv: { path: 'object-default-env' } },
     { venv: 'explicit-env', venv_python: '3.10', version: '3.10' },
     { venv: { path: 'object-env', python: '3.11' }, version: '3.11' },
@@ -413,7 +431,7 @@ test('venvs preserve creation behavior and enforce the pip minimum across shells
         message: 'echo PINOKIO_REQUIREMENTS_RAN',
       })
       const command = shell.build(params)
-      assert.doesNotMatch(command, /--seed|--no-config|--python-preference|python -I|files\.pythonhosted\.org/)
+      assert.doesNotMatch(command, /--seed|--no-config|--python-preference|uv pip install/)
       assert.match(command, /echo PINOKIO_REQUIREMENTS_RAN$/)
       if (!scenario.venv || scenario.existing) {
         assert.doesNotMatch(command, /python -m venv|uv venv/)
@@ -423,15 +441,28 @@ test('venvs preserve creation behavior and enforce the pip minimum across shells
       } else {
         assert.match(command, /python -m venv /)
       }
-      const updatePip = `uv pip install --exclude-newer-package pip=false "pip>=${PIP_MIN_VERSION}"`
-      if (scenario.venv && !scenario.version) {
-        assert.equal(command.split(updatePip).length - 1, 1)
-        assert.ok(command.indexOf(updatePip) > command.lastIndexOf('activate'))
-        assert.ok(command.includes(shell.isPowerShell()
-          ? `${updatePip}; if ($LASTEXITCODE -ne 0) { exit 1 }`
-          : `${updatePip} || exit 1`))
+      if (scenario.venv && !scenario.version && !scenario.existing) {
+        assert.equal(command.split(PIP_INSTALL_COMMAND).length - 1, 1)
+        assert.ok(command.indexOf(PIP_INSTALL_COMMAND) > command.lastIndexOf('activate'))
+        const envPath = path.resolve(root, typeof scenario.venv === 'string' ? scenario.venv : scenario.venv.path)
+        const shellPath = shell.isCmdShell() ? `"${envPath}"` : shell.quoteArgForShell(platform === 'win32' && /bash/i.test(shellName) ? require('../kernel/util').p2u(envPath) : envPath)
+        for (const step of [`python -m venv ${shellPath}`, PIP_INSTALL_COMMAND]) {
+          assert.ok(command.includes(shell.isPowerShell()
+            ? `${step}; if ($LASTEXITCODE -ne 0) { exit 1 }`
+            : `${step} || exit 1`))
+        }
       } else {
-        assert.doesNotMatch(command, /uv pip install/)
+        assert.doesNotMatch(command, /-m pip/)
+      }
+      if (scenario.venv) {
+        const envPath = path.resolve(root, typeof scenario.venv === 'string' ? scenario.venv : scenario.venv.path)
+        const script = path.resolve(envPath, platform === 'win32' ? 'Scripts' : 'bin', shell.isPowerShell() ? 'Activate.ps1' : 'activate')
+        const scriptPath = shell.isCmdShell() ? `"${script}"` : shell.quoteArgForShell(platform === 'win32' && /bash/i.test(shellName) ? require('../kernel/util').p2u(script) : script)
+        assert.ok(command.includes(shell.isPowerShell()
+          ? `& ${scriptPath}`
+          : shell.isCmdShell() ? scriptPath : `source ${scriptPath}`), command)
+        assert.ok(command.includes(shell.isPowerShell() ? '; if (!$?) { exit 1 }' : ' || exit 1'), command)
+        if (shell.isPowerShell()) assert.doesNotMatch(command, /Scripts[\\/]deactivate/)
       }
       assert.equal(shell.env.UV_PYTHON_PREFERENCE, 'only-managed')
     }
@@ -439,15 +470,22 @@ test('venvs preserve creation behavior and enforce the pip minimum across shells
 })
 
 
-test('failed pip updates stop the application even with an unconditional command chain', async t => {
+test('failed venv creation or pip bootstrap stops an unconditional command chain', async t => {
   if (process.platform === 'win32') return t.skip('executes the POSIX shell failure guard')
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-pip-failure-'))
   t.after(() => fs.rm(root, { recursive: true, force: true }))
   const binDir = path.join(root, 'bin')
-  await fs.mkdir(path.join(root, 'env', 'bin'), { recursive: true })
   await fs.mkdir(binDir)
-  await fs.writeFile(path.join(root, 'env', 'bin', 'activate'), 'true\n')
-  await fs.writeFile(path.join(binDir, 'uv'), '#!/bin/sh\nexit "$PINOKIO_TEST_UV_EXIT_CODE"\n', { mode: 0o755 })
+  await fs.writeFile(path.join(binDir, 'python'), `#!/bin/sh
+if [ "$1" = "-m" ] && [ "$2" = "venv" ]; then
+  [ "$PINOKIO_TEST_VENV_EXIT_CODE" = "0" ] || exit "$PINOKIO_TEST_VENV_EXIT_CODE"
+  mkdir -p "$3/bin"
+  echo 'deactivate() { :; }' > "$3/bin/activate"
+else
+  echo PINOKIO_PIP_BOOTSTRAP_RAN
+  exit "$PINOKIO_TEST_PIP_EXIT_CODE"
+fi
+`, { mode: 0o755 })
   const shell = createShell(createKernel(root))
   shell.shell = 'bash'
   const params = await shell.activate({
@@ -455,12 +493,105 @@ test('failed pip updates stop the application even with an unconditional command
     chain: '*', message: 'echo PINOKIO_APPLICATION_RAN',
   })
   const command = shell.build(params)
-  for (const exitCode of [0, 7]) {
+  for (const [venvExit, pipExit] of [[9, 0], [0, 7], [0, 0]]) {
     const result = spawnSync('/bin/bash', ['-c', command], {
       encoding: 'utf8',
-      env: { ...process.env, PATH: `${binDir}${path.delimiter}${process.env.PATH}`, PINOKIO_TEST_UV_EXIT_CODE: String(exitCode) },
+      env: { ...process.env, PATH: `${binDir}${path.delimiter}${process.env.PATH}`, PINOKIO_TEST_VENV_EXIT_CODE: String(venvExit), PINOKIO_TEST_PIP_EXIT_CODE: String(pipExit) },
+    })
+    assert.equal(result.status, venvExit || pipExit ? 1 : 0, result.stderr)
+    assert.equal(result.stdout.includes('PINOKIO_APPLICATION_RAN'), venvExit === 0 && pipExit === 0)
+    assert.equal(result.stdout.includes('PINOKIO_PIP_BOOTSTRAP_RAN'), venvExit === 0)
+  }
+})
+
+
+test('venv paths remain literal through creation and repeated activation', async t => {
+  if (process.platform === 'win32') return t.skip('executes bash commands')
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-venv-paths-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  const bin = path.join(root, 'bin')
+  const project = path.join(root, "project & $NAME O'Brien (test)")
+  await fs.mkdir(bin)
+  await fs.mkdir(project)
+  const fixture = path.join(root, 'activate')
+  await fs.writeFile(fixture, 'export VIRTUAL_ENV="$PINOKIO_TEST_ENV"\ndeactivate() { unset VIRTUAL_ENV; }\n')
+  const executable = `#!/bin/sh
+if [ "$1" = "-m" ] && [ "$2" = "venv" ]; then
+  [ "$#" = "3" ] || exit 9
+  target=$3
+elif [ "$1" = "venv" ]; then
+  [ "$#" = "4" ] || exit 9
+  target=$2
+else
+  echo "PINOKIO_BOOTSTRAP_TARGET=$VIRTUAL_ENV"
+  exit 0
+fi
+printf '%s' "$target" > "$PINOKIO_TEST_CREATED"
+mkdir -p "$target/bin"
+cp "$PINOKIO_TEST_ACTIVATE" "$target/bin/activate"
+`
+  await fs.writeFile(path.join(bin, 'python'), executable, { mode: 0o755 })
+  await fs.writeFile(path.join(bin, 'uv'), executable, { mode: 0o755 })
+  for (const explicit of [false, true]) {
+    const venv = explicit ? 'uv env $NAME' : 'default env $NAME'
+    const envPath = path.join(project, venv)
+    const created = path.join(root, 'created')
+    for (const existing of [false, true]) {
+      const shell = createShell(createKernel(root))
+      shell.shell = 'bash'
+      const params = await shell.activate({
+        path: project, conda: { skip: true }, venv,
+        ...(explicit ? { venv_python: '3.10' } : {}),
+        chain: '*', message: 'printf "PINOKIO_APP_TARGET=%s\\n" "$VIRTUAL_ENV"',
+      })
+      const result = spawnSync('/bin/bash', ['-c', shell.build(params)], {
+        encoding: 'utf8', env: {
+          ...process.env, PATH: `${bin}${path.delimiter}${process.env.PATH}`,
+          VIRTUAL_ENV: '', NAME: 'must-not-expand',
+          PINOKIO_TEST_ENV: envPath, PINOKIO_TEST_CREATED: created, PINOKIO_TEST_ACTIVATE: fixture,
+        },
+      })
+      assert.equal(result.status, 0, result.stdout + result.stderr)
+      assert.equal(await fs.readFile(created, 'utf8'), envPath)
+      assert.ok(result.stdout.includes(`PINOKIO_APP_TARGET=${envPath}\n`), result.stdout)
+      assert.equal(result.stdout.includes(`PINOKIO_BOOTSTRAP_TARGET=${envPath}\n`), !explicit && !existing)
+    }
+  }
+})
+
+test('failed activation stops before pip or application commands', async t => {
+  if (process.platform === 'win32') return t.skip('executes bash commands')
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-venv-activation-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  const bin = path.join(root, 'bin')
+  await fs.mkdir(bin)
+  await fs.writeFile(path.join(bin, 'python'), `#!/bin/sh
+if [ "$1" = "-m" ] && [ "$2" = "venv" ]; then
+  mkdir -p "$3/bin"
+  if [ "$PINOKIO_TEST_FAILURE" = "second" ]; then
+    echo 'deactivate() { rm -f "$PINOKIO_TEST_ENV/bin/activate"; }' > "$3/bin/activate"
+  fi
+else
+  echo PINOKIO_BOOTSTRAP_RAN
+fi
+`, { mode: 0o755 })
+  for (const failure of ['first', 'second', 'existing']) {
+    const venv = `${failure} env`
+    if (failure === 'existing') await fs.mkdir(path.join(root, venv))
+    const shell = createShell(createKernel(root))
+    shell.shell = 'bash'
+    const params = await shell.activate({
+      path: root, conda: { skip: true }, venv,
+      chain: '*', message: 'echo PINOKIO_APPLICATION_RAN',
+    })
+    const result = spawnSync('/bin/bash', ['-c', shell.build(params)], {
+      encoding: 'utf8', env: {
+        ...process.env, PATH: `${bin}${path.delimiter}${process.env.PATH}`,
+        PINOKIO_TEST_FAILURE: failure, PINOKIO_TEST_ENV: path.join(root, venv),
+      },
     })
-    assert.equal(result.status, exitCode ? 1 : 0, result.stderr)
-    assert.equal(result.stdout.includes('PINOKIO_APPLICATION_RAN'), exitCode === 0)
+    assert.equal(result.status, 1, `${failure}: ${result.stdout}${result.stderr}`)
+    assert.equal(result.stdout.includes('PINOKIO_BOOTSTRAP_RAN'), false, failure)
+    assert.equal(result.stdout.includes('PINOKIO_APPLICATION_RAN'), false, failure)
   }
 })