@synopackageland/cli 0.10.5 → 0.10.7

package/CHANGELOG.md

@@ -1,5 +1,82 @@
 # Changelog
 
+## 0.10.7 (2026-10-15)
+
+Builds with SDK 0.10.7 and templates 0.10.8: `init` writes SDK v0.10.7 (Go
+module, Rust crate tag and `backend.sdk`), `@synopackageland/sdk` 0.10.7 and
+`@synopackageland/ui` 0.9.8. The executor digest table adds SDK 0.10.7, whose
+executor and lifecycle digests equal 0.10.6, so an App rebuilt on it keeps its
+approval unless its executor or policy changes. The CLI still needs SDK
+0.10.5 or later: `ctx.portal.lastStatus()` is new and optional, SDK 0.10.7's
+`PortalSettings` keeps its placeholder rows without it, and older SDKs do not
+read it; nothing in the CLI depends on SDK 0.10.7. An App gets the settings
+page without placeholder movement only with both SDK 0.10.7 and a DSM window
+built by CLI 0.10.7.
+
+繁中摘要：搭配 SDK 0.10.7、templates 0.10.8（UI 0.9.8）；digest 與 0.10.6 相同；SDK 下限維持
+0.10.5（`ctx.portal.lastStatus()` 是選用的新增，舊 SDK 不讀、SDK 0.10.7 沒有它就畫佔位列）。
+e2e 新增 `openUntilLoaded`（`signIn` 遇 `net::ERR_ABORTED` 最多重開約 30 s）、遮蔽 socket.io `sid=`。
+
+- `signIn` and `dsmLoginSetup` keep reopening DSM's login page while the
+  navigation fails with `net::ERR_ABORTED`, for up to about 30 s, after a saved
+  profile is refused (error 119); they then fail with a clear error. Any other
+  error still fails at once. The helper is exported as
+  `openUntilLoaded(app, path, {timeoutMs, pauseMs})`.
+- e2e output and report masking also masks the `sid=` query parameter of DSM's
+  socket.io URLs, which carries the connection id.
+- `ctx.portal` reads the portal status when the DSM window opens and keeps
+  the newest one it read (`lastStatus()`); a `status()` asked for while a read
+  runs shares it. The SDK's `PortalSettings` starts from it, so a settings
+  page no longer moves when its placeholder rows become the real section
+  (Reclaim: 100 px, t-0520).
+
+## 0.10.6 (2026-10-15)
+
+Builds with SDK 0.10.6 and templates 0.10.7: `init` writes SDK v0.10.6 (Go
+module, Rust crate tag and `backend.sdk`), `@synopackageland/sdk` 0.10.6 and
+`@synopackageland/ui` 0.9.8, whose `CellText` takes `wrap`. Templates 0.10.6
+was tagged but not published (a failing delegate frontend test); 0.10.7 is the
+same templates with that test fixed. The executor digest table adds SDK 0.10.6,
+whose executor and lifecycle digests equal 0.10.5, so an App rebuilt on it keeps
+its approval unless its own root programs change. The CLI still needs SDK 0.10.5
+or later: SDK 0.10.5's panels already read `executor_starting` as a starting
+package and check again, and nothing in the CLI depends on SDK 0.10.6.
+
+繁中摘要：搭配 SDK 0.10.6、templates 0.10.7（UI 0.9.8）；templates 0.10.6 有 tag 但未發佈；
+digest 與 0.10.5 相同；SDK 下限維持 0.10.5。e2e 新增 `openPath`、`handleDialogs`、80/443 通道。
+
+- `signIn`, `openDesktop` and `openPortal` open their page once more when
+  the first navigation fails with `net::ERR_ABORTED`, which about one run in
+  ten met as DSM's desktop navigated on its own (t-0499, t-0500); any other
+  failure, or a second abort, still fails. The helper is exported as
+  `openPath(app, path)`.
+- The DSM window's `status()` answers a pinned executor that reports
+  `state: "starting"` (its `root.start` step) at once, blocked with code
+  `executor_starting` and no approval offered, instead of waiting up to 75 s
+  for the step. The SDK's panels read that code as a starting package and
+  check again on their own, as they do `APP_STARTING` since CLI 0.10.5.
+  Approving and `control("start")` still wait for the step.
+- `openApp(app, appId, timeout, browser)` and `openPortal(app, path, browser)`
+  take the test's `browser` fixture and accept native alert and confirm dialogs
+  through its `onDialog`, recording their text (`handleDialogs(browser)` returns
+  the list). DSM's `alert("You are not authorized to use this service.")` no
+  longer fails the test as an unhandled dialog. Without `browser` nothing
+  changes.
+- `openPortal` registers the session's cookies as e2e secrets too (a portal
+  page may have no SynoToken, which is no failure); only `signIn` and
+  `openDesktop` did.
+- `signIn` accepts a restored profile only when the desktop holds a SynoToken
+  and DSM's `/webman/login.cgi` still accepts the session (`dsmSessionLive`).
+  A profile with only the `stay_login` cookie, or an expired session (DSM error
+  119), now clears the cookies and signs in again with the account file's
+  password; the desktop alone used to be enough, and the app's CGIs then
+  answered "authorization unavailable".
+- `runWithTunnel` also forwards the NAS's port 80 and 443 when
+  `DSM_E2E_TUNNEL_HTTP_PORT` and `DSM_E2E_TUNNEL_HTTPS_PORT` name local ports
+  (portal alias tests), and hands both to the command; the targets default to
+  80 and 443 (`DSM_E2E_REMOTE_HTTP_PORT`, `DSM_E2E_REMOTE_HTTPS_PORT`). Without
+  them the tunnel is unchanged.
+
 ## 0.10.5 (2026-10-15)
 
 Builds with SDK 0.10.5 and templates 0.10.5: `init` writes SDK v0.10.5 (Go

package/README.md

@@ -98,7 +98,8 @@ it as root once at the first start of each new version, while the administrator'
 live, for at most 60 seconds; a failure is logged and does not block the start, and the executor
 `status` reports the result as `start_step`. While it runs, the executor answers only `status`
 (`state: "starting"`) and refuses other requests with the retryable `EXECUTOR_STARTING`; the DSM
-window's approval waits for it. The program cannot declare `run` or `job`, and
+window's approval waits for it, while a status read answers `executor_starting` at once and the
+SDK's panels check again on their own. The program cannot declare `run` or `job`, and
 declaring it changes the policy digest, so an administrator approves the App again.
 
 ## Commands

package/dist/e2e/dsm.d.ts

@@ -3,6 +3,12 @@ type Env = Readonly<Record<string, string | undefined>>;
 type App = {
     open(path?: string): Promise<unknown>;
 };
+type DialogBrowser = {
+    onDialog(handler: (dialog: {
+        message: string;
+        accept(): Promise<void>;
+    }) => Promise<void>): Promise<unknown>;
+};
 type StorageState = {
     cookies: unknown[];
     origins: unknown[];
@@ -11,20 +17,22 @@ type Page = ReturnType<NonNullable<ReturnType<typeof surfaceOf>>["page"]>;
 type Locator = ReturnType<Page["locator"]>;
 /** The DSM URL the browser opens: DSM_E2E_URL, else the local end of the SSH tunnel. */
 export declare function dsmUrl(env?: Env): string;
-/** ssh arguments forwarding the loopback port DSM_E2E_TUNNEL_PORT (default 15000) to DSM's HTTP port on the NAS. */
+/** ssh arguments forwarding the loopback ports of `forwards` to the NAS. */
 export declare function tunnelArgs(env?: Env): string[];
 /** A loopback port nothing listens on now, for a tunnel that names none. */
 export declare function freePort(): Promise<number>;
 /**
  * Opens the SSH tunnel on DSM_E2E_TUNNEL_PORT, else on a free port, runs
  * `command` with DSM_E2E_URL pointing at it, and closes the tunnel afterwards.
+ * DSM_E2E_TUNNEL_HTTP_PORT and DSM_E2E_TUNNEL_HTTPS_PORT, when set, also
+ * forward the NAS's port 80 and 443 (see forwards) and reach the command's env.
  * The command's output reaches this process's stdout and stderr with DSM's
  * secrets masked, and its e2e output directory, DSM_E2E_OUTPUT_DIR (default
  * .e2e), is protected afterwards (see protectE2eOutput). Resolves to the
  * command's exit code.
  */
 export declare function runWithTunnel(command: readonly string[], outer?: Env): Promise<number>;
-/** `text` with DSM's session cookies, X-SYNO-TOKEN, SynoToken and _sid values replaced by ***. */
+/** `text` with DSM's session cookies, X-SYNO-TOKEN, SynoToken, _sid and sid values replaced by ***. */
 export declare function redactDsmSecrets(text: string): string;
 /**
  * Makes an e2e output directory private (directories 700, files 600) and masks
@@ -100,6 +108,15 @@ type SessionPage = {
  * Playwright call log carries them (t-0498). Returns how many were registered.
  */
 export declare function registerDsmSecrets(page?: SessionPage, ledger?: SecretLedger): Promise<number>;
+/**
+ * Has the attempt's native alert and confirm dialogs accepted and returns the
+ * live list of their texts, so a DSM `alert("You are not authorized to use this
+ * service.")` does not fail the test and a test can still assert on it. e2e 0.19
+ * routes dialogs through the `browser` fixture's onDialog (Playwright's
+ * page.on('dialog') does not reach them), so a helper needs that fixture:
+ * openApp and openPortal take it and call this. Registers once per browser.
+ */
+export declare function handleDialogs(browser: DialogBrowser): Promise<string[]>;
 /** Waits until the DSM desktop and its signed-in taskbar are shown. */
 export declare function waitForDesktop(page?: Page): Promise<void>;
 /**
@@ -109,9 +126,36 @@ export declare function waitForDesktop(page?: Page): Promise<void>;
  * DSM_E2E_NOTIFICATION_WAIT_MS (default 5000) for one.
  */
 export declare function dismissNotifications(page?: Page, env?: Env): Promise<number>;
+/**
+ * Whether the signed-in desktop's session is usable: it holds a SynoToken
+ * (a restored `stay_login` cookie alone yields none, and the app's CGIs then
+ * answer 119) and DSM's login.cgi, asked from the page, still accepts the
+ * session. Any failure to ask counts as not live.
+ */
+export declare function dsmSessionLive(page: Pick<SessionPage, "evaluate">): Promise<boolean>;
+/**
+ * `app.open(path)`, once more after net::ERR_ABORTED: about one first
+ * navigation in ten was aborted as DSM's desktop navigated on its own, and the
+ * next one loaded (t-0499, t-0500). Any other failure, or a second abort, is
+ * thrown.
+ */
+export declare function openPath(app: Pick<App, "open">, path: string): Promise<void>;
+/**
+ * `app.open(path)`, repeated while it fails with net::ERR_ABORTED: a refused
+ * session's old desktop JS keeps navigating and aborted several opens in a row.
+ * Gives up with a clear error after `timeoutMs` (30 s); any other failure is
+ * thrown at once.
+ */
+export declare function openUntilLoaded(app: Pick<App, "open">, path: string, { timeoutMs, pauseMs, now, sleep }?: {
+    timeoutMs?: number | undefined;
+    pauseMs?: number | undefined;
+    now?: (() => number) | undefined;
+    sleep?: ((ms: number) => Promise<void>) | undefined;
+}): Promise<void>;
 /**
  * Restores the saved profile of `user`; signs in with the account file only
- * when that profile is missing or no longer reaches the desktop. Saves the
+ * when that profile is missing, no longer reaches the desktop, or gives a
+ * session without a SynoToken or that DSM refuses (dsmSessionLive). Saves the
  * resulting state and returns which path it took.
  */
 export declare function signIn(app: App, user?: string, env?: Env): Promise<"restored" | "signed-in">;
@@ -129,9 +173,18 @@ export declare function openDesktop(app: App): Promise<Page>;
 /**
  * Opens the DSM app `appId` (for example SYNO.SDS.SynoPkgConnect.Instance) in
  * its desktop window, or brings its open window to the front, and returns it
- * once the app has rendered text into the window.
+ * once the app has rendered text into the window. With the `browser` fixture,
+ * native dialogs are accepted and recorded (see handleDialogs).
+ */
+export declare function openApp(app: App, appId: string, timeout?: number, browser?: DialogBrowser): Promise<Locator>;
+/**
+ * Waits until an Application Portal page has loaded and registers the session's
+ * cookies as e2e secrets. A portal page has no SynoToken, which is no failure.
+ */
+export declare function waitForPortal(page?: Page): Promise<void>;
+/**
+ * Opens an Application Portal page (for example /download-hub/) as the whole
+ * tab. With the `browser` fixture, native dialogs are accepted and recorded (see handleDialogs).
  */
-export declare function openApp(app: App, appId: string, timeout?: number): Promise<Locator>;
-/** Opens an Application Portal page (for example /download-hub/) as the whole tab. */
-export declare function openPortal(app: App, path: string): Promise<Page>;
+export declare function openPortal(app: App, path: string, browser?: DialogBrowser): Promise<Page>;
 export {};

package/dist/e2e/dsm.js

@@ -1,7 +1,8 @@
 // DSM helpers for package e2e suites on upstream `e2e` + `@e2e-dev/web`.
 // One self-contained file: a package may copy it verbatim to tests/e2e/support/dsm.ts.
 // It signs in once per run (a saved, private profile is restored when still valid),
-// opens DSM app windows and Application Portal pages, dismisses DSM notifications,
+// opens DSM app windows and Application Portal pages (accepting their native
+// dialogs when given the `browser` fixture), dismisses DSM notifications,
 // configures the magpie LLM, and runs a command through an SSH tunnel to the NAS
 // (on a free loopback port unless DSM_E2E_TUNNEL_PORT names one). DSM's session
 // cookies and tokens are masked in what that command prints and leaves in its
@@ -26,12 +27,25 @@ const loginSelector = 'input[name="username"]';
 export function dsmUrl(env = process.env) {
     return env.DSM_E2E_URL || `http://127.0.0.1:${env.DSM_E2E_TUNNEL_PORT || "15000"}/`;
 }
-/** ssh arguments forwarding the loopback port DSM_E2E_TUNNEL_PORT (default 15000) to DSM's HTTP port on the NAS. */
+/**
+ * The loopback ports to forward as [local, remote]: DSM_E2E_TUNNEL_PORT (default 15000)
+ * to DSM's web port, and, only when named, DSM_E2E_TUNNEL_HTTP_PORT and
+ * DSM_E2E_TUNNEL_HTTPS_PORT to the NAS's port 80 and 443 (DSM_E2E_REMOTE_HTTP_PORT
+ * and DSM_E2E_REMOTE_HTTPS_PORT override them), for Application Portal alias pages.
+ */
+function forwards(env) {
+    const extra = (local, remote, fallback) => local ? [[local, remote || fallback]] : [];
+    return [
+        [env.DSM_E2E_TUNNEL_PORT || "15000", env.DSM_E2E_REMOTE_PORT || "5000"],
+        ...extra(env.DSM_E2E_TUNNEL_HTTP_PORT, env.DSM_E2E_REMOTE_HTTP_PORT, "80"),
+        ...extra(env.DSM_E2E_TUNNEL_HTTPS_PORT, env.DSM_E2E_REMOTE_HTTPS_PORT, "443"),
+    ];
+}
+/** ssh arguments forwarding the loopback ports of `forwards` to the NAS. */
 export function tunnelArgs(env = process.env) {
-    const local = env.DSM_E2E_TUNNEL_PORT || "15000";
-    const remote = env.DSM_E2E_REMOTE_PORT || "5000";
     return ["-N", "-o", "BatchMode=yes", "-o", "ExitOnForwardFailure=yes",
-        "-L", `127.0.0.1:${local}:127.0.0.1:${remote}`, env.DSM_E2E_SSH || "root@vt-nas.syno"];
+        ...forwards(env).flatMap(([local, remote]) => ["-L", `127.0.0.1:${local}:127.0.0.1:${remote}`]),
+        env.DSM_E2E_SSH || "root@vt-nas.syno"];
 }
 /** A loopback port nothing listens on now, for a tunnel that names none. */
 export function freePort() {
@@ -54,6 +68,8 @@ function portOpen(port) {
 /**
  * Opens the SSH tunnel on DSM_E2E_TUNNEL_PORT, else on a free port, runs
  * `command` with DSM_E2E_URL pointing at it, and closes the tunnel afterwards.
+ * DSM_E2E_TUNNEL_HTTP_PORT and DSM_E2E_TUNNEL_HTTPS_PORT, when set, also
+ * forward the NAS's port 80 and 443 (see forwards) and reach the command's env.
  * The command's output reaches this process's stdout and stderr with DSM's
  * secrets masked, and its e2e output directory, DSM_E2E_OUTPUT_DIR (default
  * .e2e), is protected afterwards (see protectE2eOutput). Resolves to the
@@ -64,17 +80,22 @@ export async function runWithTunnel(command, outer = process.env) {
         throw new Error("runWithTunnel needs a command to run.");
     const port = Number(outer.DSM_E2E_TUNNEL_PORT || await freePort());
     const env = { ...outer, DSM_E2E_TUNNEL_PORT: String(port) };
-    if (await portOpen(port))
-        throw new Error(`Port ${port} is already in use; set DSM_E2E_TUNNEL_PORT or close it before opening the tunnel.`);
+    const ports = forwards(env).map(([local]) => Number(local));
+    for (const used of ports) {
+        if (await portOpen(used))
+            throw new Error(`Port ${used} is already in use; name another DSM_E2E_TUNNEL_* port or close it before opening the tunnel.`);
+    }
     const ssh = spawn(env.DSM_E2E_SSH_BIN || "ssh", tunnelArgs(env), { stdio: ["ignore", "ignore", "inherit"] });
     let sshExited = false;
     ssh.once("exit", () => { sshExited = true; });
     try {
         const deadline = Date.now() + Number(env.DSM_E2E_TUNNEL_TIMEOUT_MS || "15000");
-        while (!(await portOpen(port))) {
-            if (sshExited || Date.now() > deadline)
-                throw new Error(`The SSH tunnel to ${tunnelArgs(env).at(-1)} did not open on port ${port}.`);
-            await new Promise(accept => setTimeout(accept, 100));
+        for (const waiting of ports) {
+            while (!(await portOpen(waiting))) {
+                if (sshExited || Date.now() > deadline)
+                    throw new Error(`The SSH tunnel to ${tunnelArgs(env).at(-1)} did not open on port ${waiting}.`);
+                await new Promise(accept => setTimeout(accept, 100));
+            }
         }
         // Piped output loses the terminal, not its colours.
         const color = process.stdout.isTTY && env.FORCE_COLOR === undefined ? { FORCE_COLOR: "1" } : {};
@@ -117,10 +138,10 @@ const mask = "***";
 const cookieHeader = /(\bcookie"?\s*[:=]\s*"?)([^"\\\r\n]*)/gi;
 const sessionCookieNames = ["id", "did", "_SSID"];
 const sessionCookie = new RegExp(`(^|;\\s*)(${sessionCookieNames.join("|")})=[^;\\s]*`, "gi");
-// The X-SYNO-TOKEN header, a SynoToken parameter or field, and a web API's _sid parameter.
+// The X-SYNO-TOKEN header, a SynoToken parameter or field, a web API's _sid parameter and a socket.io connection's sid parameter.
 const tokenValue = /(\b(?:x-syno-token|synotoken)"?\s*[:=]\s*"?)[^"\\\s,;&}]+/gi;
-const sidParameter = /([?&]_sid=)[^&"\\\s]+/gi;
-/** `text` with DSM's session cookies, X-SYNO-TOKEN, SynoToken and _sid values replaced by ***. */
+const sidParameter = /([?&]_?sid=)[^&"\\\s]+/gi;
+/** `text` with DSM's session cookies, X-SYNO-TOKEN, SynoToken, _sid and sid values replaced by ***. */
 export function redactDsmSecrets(text) {
     return text
         .replace(cookieHeader, (_match, header, cookies) => header + cookies.replace(sessionCookie, `$1$2=${mask}`))
@@ -314,6 +335,25 @@ export async function registerDsmSecrets(page = dsmPage(), ledger) {
         target.register(name, value);
     return values.length;
 }
+const dialogLogs = new WeakMap();
+/**
+ * Has the attempt's native alert and confirm dialogs accepted and returns the
+ * live list of their texts, so a DSM `alert("You are not authorized to use this
+ * service.")` does not fail the test and a test can still assert on it. e2e 0.19
+ * routes dialogs through the `browser` fixture's onDialog (Playwright's
+ * page.on('dialog') does not reach them), so a helper needs that fixture:
+ * openApp and openPortal take it and call this. Registers once per browser.
+ */
+export async function handleDialogs(browser) {
+    let messages = dialogLogs.get(browser);
+    if (!messages) {
+        const seen = [];
+        messages = seen;
+        dialogLogs.set(browser, seen);
+        await browser.onDialog(async (dialog) => { seen.push(dialog.message); await dialog.accept(); });
+    }
+    return messages;
+}
 /** Waits until the DSM desktop and its signed-in taskbar are shown. */
 export async function waitForDesktop(page = dsmPage()) {
     await page.locator(desktopSelector).waitFor({ state: "visible", timeout: 60_000 });
@@ -342,6 +382,20 @@ export async function dismissNotifications(page = dsmPage(), env = process.env)
     }
     return closed;
 }
+/**
+ * Whether the signed-in desktop's session is usable: it holds a SynoToken
+ * (a restored `stay_login` cookie alone yields none, and the app's CGIs then
+ * answer 119) and DSM's login.cgi, asked from the page, still accepts the
+ * session. Any failure to ask counts as not live.
+ */
+export async function dsmSessionLive(page) {
+    const state = await page.evaluate(async () => {
+        const token = window.SYNO?.SDS?.Session?.SynoToken;
+        const reply = await fetch("/webman/login.cgi", { credentials: "same-origin" }).then(response => response.json());
+        return { token: typeof token === "string" && token !== "", success: reply?.success === true };
+    }).catch(() => undefined);
+    return !!state?.token && state.success;
+}
 function accountFile(user, env) {
     const key = `DSM_E2E_ACCOUNT_${user.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
     const file = env[key];
@@ -349,9 +403,53 @@ function accountFile(user, env) {
         throw new Error(`Set ${key} to the account file for ${user} (mode 600).`);
     return resolve(file);
 }
+/**
+ * `app.open(path)`, once more after net::ERR_ABORTED: about one first
+ * navigation in ten was aborted as DSM's desktop navigated on its own, and the
+ * next one loaded (t-0499, t-0500). Any other failure, or a second abort, is
+ * thrown.
+ */
+export async function openPath(app, path) {
+    try {
+        await app.open(path);
+    }
+    catch (error) {
+        if (!/net::ERR_ABORTED/.test(String(error?.message ?? error)))
+            throw error;
+        await app.open(path);
+    }
+}
+/**
+ * `app.open(path)`, repeated while it fails with net::ERR_ABORTED: a refused
+ * session's old desktop JS keeps navigating and aborted several opens in a row.
+ * Gives up with a clear error after `timeoutMs` (30 s); any other failure is
+ * thrown at once.
+ */
+export async function openUntilLoaded(app, path, { timeoutMs = 30_000, pauseMs = 1_000, now = Date.now, sleep = (ms) => new Promise(done => setTimeout(done, ms)) } = {}) {
+    const deadline = now() + timeoutMs;
+    for (;;) {
+        try {
+            await app.open(path);
+            return;
+        }
+        catch (error) {
+            const message = String(error?.message ?? error);
+            if (!/net::ERR_ABORTED/.test(message))
+                throw error;
+            if (now() + pauseMs >= deadline) {
+                throw new Error(`Opening ${path} still aborted after ${Math.round(timeoutMs / 1000)} s of retries: ${message}`);
+            }
+            await sleep(pauseMs);
+        }
+    }
+}
+async function restoredSessionLive(page) {
+    return await desktopOrLogin(page) === "desktop" && await dsmSessionLive(page);
+}
 /**
  * Restores the saved profile of `user`; signs in with the account file only
- * when that profile is missing or no longer reaches the desktop. Saves the
+ * when that profile is missing, no longer reaches the desktop, or gives a
+ * session without a SynoToken or that DSM refuses (dsmSessionLive). Saves the
  * resulting state and returns which path it took.
  */
 export async function signIn(app, user = "admin", env = process.env) {
@@ -361,12 +459,15 @@ export async function signIn(app, user = "admin", env = process.env) {
     const profile = loadProfile(file, url);
     if (profile)
         await context.setStorageState(profile);
-    await app.open("/");
+    await openPath(app, "/");
     const page = dsmPage();
     let outcome = "restored";
-    if (!profile || await desktopOrLogin(page) === "login") {
-        if (profile)
-            await app.open("/");
+    if (!profile || !await restoredSessionLive(page)) {
+        // A refused session still shows the desktop; dropping its cookies shows the login form.
+        if (profile) {
+            await context.clearCookies();
+            await openUntilLoaded(app, "/");
+        }
         const account = readAccount(accountFile(user, env), user);
         await page.locator(loginSelector).fill(account.username);
         await page.keyboard.press("Enter");
@@ -403,7 +504,7 @@ export async function openDesktop(app) {
     } })();
     if (current && await current.locator(desktopSelector).isVisible().catch(() => false))
         return current;
-    await app.open("/");
+    await openPath(app, "/");
     const page = dsmPage();
     if (await desktopOrLogin(page) === "login")
         throw new Error("The DSM session is signed out; declare the session that dsmLoginSetup saves.");
@@ -415,9 +516,12 @@ export async function openDesktop(app) {
 /**
  * Opens the DSM app `appId` (for example SYNO.SDS.SynoPkgConnect.Instance) in
  * its desktop window, or brings its open window to the front, and returns it
- * once the app has rendered text into the window.
+ * once the app has rendered text into the window. With the `browser` fixture,
+ * native dialogs are accepted and recorded (see handleDialogs).
  */
-export async function openApp(app, appId, timeout = 30_000) {
+export async function openApp(app, appId, timeout = 30_000, browser) {
+    if (browser)
+        await handleDialogs(browser);
     const page = await openDesktop(app);
     await page.evaluate(id => window.SYNO.SDS.AppLaunch(id), appId);
     const handle = await page.waitForFunction(id => {
@@ -430,13 +534,26 @@ export async function openApp(app, appId, timeout = 30_000) {
     await page.waitForFunction(windowId => document.getElementById(windowId)?.querySelector(".x-window-body")?.innerText.trim(), id, { timeout });
     return page.locator(`#${id}`);
 }
-/** Opens an Application Portal page (for example /download-hub/) as the whole tab. */
-export async function openPortal(app, path) {
+/**
+ * Waits until an Application Portal page has loaded and registers the session's
+ * cookies as e2e secrets. A portal page has no SynoToken, which is no failure.
+ */
+export async function waitForPortal(page = dsmPage()) {
+    await page.waitForLoadState("load");
+    await registerDsmSecrets(page);
+}
+/**
+ * Opens an Application Portal page (for example /download-hub/) as the whole
+ * tab. With the `browser` fixture, native dialogs are accepted and recorded (see handleDialogs).
+ */
+export async function openPortal(app, path, browser) {
     if (!path.startsWith("/") || path.startsWith("//"))
         throw new Error("openPortal takes a same-origin path such as /download-hub/.");
-    await app.open(path);
+    if (browser)
+        await handleDialogs(browser);
+    await openPath(app, path);
     const page = dsmPage();
-    await page.waitForLoadState("load");
+    await waitForPortal(page);
     return page;
 }
 // ---- Command line ---------------------------------------------------------

package/dist/runtime/executor-digests.json

@@ -64,5 +64,27 @@
             "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
         },
         "goToolchain": "go1.26.9"
+    },
+    "0.10.6": {
+        "x86_64": "4ba7040761a719e74d6b047ef68b9415e658ebb8b373b69555b8c307524e26ba",
+        "aarch64": "ba80b389e3291419389b66be7b0a0e1085d3dfec55c9c651fecae427279bb3d5",
+        "armv7": "49474467b9c9a7f31b30b5053b70eb4f71a95f2c06fbf3566e8de8f16972a299",
+        "lifecycle": {
+            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
+            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
+            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
+        },
+        "goToolchain": "go1.26.9"
+    },
+    "0.10.7": {
+        "x86_64": "4ba7040761a719e74d6b047ef68b9415e658ebb8b373b69555b8c307524e26ba",
+        "aarch64": "ba80b389e3291419389b66be7b0a0e1085d3dfec55c9c651fecae427279bb3d5",
+        "armv7": "49474467b9c9a7f31b30b5053b70eb4f71a95f2c06fbf3566e8de8f16972a299",
+        "lifecycle": {
+            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
+            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
+            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
+        },
+        "goToolchain": "go1.26.9"
     }
 }

package/dist/standalone/portal-window.d.ts

@@ -17,6 +17,9 @@ export declare function portalCatalogs(sdkDir: string): PortalCatalogs;
  * status or reject `{code}`. With `options.entry` (below DSM 7.2) the
  * backend's `portal.status` also reports the executor's entry, and
  * administrators get `register()` and `unregister()`; `openControlPanel()` opens Login Portal > Applications.
+ * `lastStatus()` is the newest status read; the access reads one when it is
+ * created, as the window opens, and a `status()` asked for while a read runs
+ * shares it.
  * `messages` is the SDK's panel text in the window's locale; `mountPanel(element)`
  * renders a plain panel for UIs without their own.
  */

package/dist/standalone/portal-window.js

@@ -24,6 +24,9 @@ export function portalCatalogs(sdkDir) {
  * status or reject `{code}`. With `options.entry` (below DSM 7.2) the
  * backend's `portal.status` also reports the executor's entry, and
  * administrators get `register()` and `unregister()`; `openControlPanel()` opens Login Portal > Applications.
+ * `lastStatus()` is the newest status read; the access reads one when it is
+ * created, as the window opens, and a `status()` asked for while a read runs
+ * shares it.
  * `messages` is the SDK's panel text in the window's locale; `mountPanel(element)`
  * renders a plain panel for UIs without their own.
  */
@@ -88,29 +91,49 @@ export const portalRuntime = (catalogs) => `function createPortalAccess(options)
   // The backend reports cleanup-required while a register or unregister runs,
   // so a status read waits for the change, whatever its result.
   var changing = Promise.resolve();
-  function status() {
+  // last: the newest status read, which the SDK's PortalSettings shows before it
+  // reads again. A read that runs serves every status() asked for meanwhile,
+  // until a change starts; the change reads afresh.
+  var last, pending, reads = 0;
+  function read() {
+    var n = ++reads;
     return changing.then(function () {
       if (options.entry) return fromEntry();
       return options.isAdmin() ? fromDsm() : fromBackend();
+    }).then(function (out) {
+      if (n === reads) last = out;
+      return out;
     });
   }
+  function status() {
+    if (!pending) {
+      pending = read();
+      var done = function () { pending = undefined; };
+      pending.then(done, done);
+    }
+    return pending;
+  }
   function change(method) {
     if (!options.isAdmin()) return Promise.reject({ code: "admin_required" });
     var call = options.call(method, {});
     changing = call.then(function () {}, function () {});
-    return call.then(status, function (error) {
+    pending = undefined;
+    return call.then(read, function (error) {
       throw { code: error && error.code === "ADMIN_REQUIRED" ? "admin_required" : "PORTAL_FAILED" };
     });
   }
   function set(alias) {
     if (!options.isAdmin()) return Promise.reject({ code: "admin_required" });
-    return options.send("SYNO.Core.AppPortal", "set", 2, { id: options.appId, alias: alias }).then(status, function (error) {
+    return options.send("SYNO.Core.AppPortal", "set", 2, { id: options.appId, alias: alias }).then(read, function (error) {
       throw { code: ERRORS[error && error.code] || "portal_unavailable" };
     });
   }
   var access = {
     messages: messages,
     status: status,
+    lastStatus: function () {
+      return last;
+    },
     apply: function (alias) {
       if (typeof alias !== "string" || !ALIAS.test(alias)) return Promise.reject({ code: "portal_alias_invalid" });
       if (RESERVED.indexOf(alias) >= 0) return Promise.reject({ code: "portal_alias_reserved" });
@@ -180,5 +203,8 @@ export const portalRuntime = (catalogs) => `function createPortalAccess(options)
       dispose: function () { disposed = true; element.replaceChildren(); }
     };
   }
+  // The window reads the status when it opens, so a settings page shows the
+  // portal section as it is (t-0520).
+  status();
   return access;
 }`;

package/dist/standalone/root-window.js

@@ -236,7 +236,7 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
     function readSelection(budget, delay) {
       delay = Math.min(delay || 500, 1000);
       verified.state = "ready";
-      return health(verified, 0).then(function (current) {
+      return health(verified).then(function (current) {
         if (current.state === "ready" && current.executor.selection && current.executor.selection.scope === selectedScope && Number.isSafeInteger(current.executor.selection.generation) && current.executor.selection.generation > 0) return current;
         if (budget >= delay && options.wait) return options.wait(delay).then(function () { return readSelection(budget - delay, delay * 2); });
         throw fail("executor_selection_unconfirmed");
@@ -304,9 +304,15 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       throw e;
     });
   }
-  function health(verified, budget) {
+  // step: how long to wait for a start step (ms). A status read waits none:
+  // executor_starting says the package is starting, which the SDK checks
+  // again on its own.
+  function health(verified, step) {
     if (verified.state !== "ready") return Promise.resolve(verified);
-    return settle(verified, alive(budget));
+    return settle(verified, alive(0, undefined, step)).then(function (result) {
+      if (result.code === "executor_starting") delete result.retry;
+      return result;
+    });
   }
   function settle(verified, status) {
     return status.then(function (current) { verified.executor = current; return verified; }, function (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.10.5",
+  "version": "0.10.7",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -25,7 +25,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@synopackageland/templates": "0.10.5",
+    "@synopackageland/templates": "0.10.8",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "tar": "^7.4.3",

package/skills/reference/create.md

@@ -112,7 +112,7 @@ root:
     migrate: {}          # 沒有 run、job：只作為 start 步驟
 ```
 
-start、stop 步驟與 `uninstall.purge.root` 都以 root、無 session 執行，只在管理員核准有效時跑；這些程式不能宣告 run 或 job（session 要用時以另一個名稱設定，可指向同一份內容）。start 步驟在新版本第一次啟動、executor 開 socket 並回讀核准任務之後執行，最多 60 秒；執行期間 executor 只回應 `status`（`state: "starting"`），其他請求回可重試的 `EXECUTOR_STARTING`，DSM 視窗的核准會等它結束，失敗只寫進 executor log，不擋啟動；同一版本不重跑，程式要能重複執行。結果由 executor `status` 的 `start_step` 讀取（`pending`、`ok`、`failed`，含 exit 與 output）。DSM 的 start 只寫入要求就返回，所以 `dsm-scripts/postinst`、`postupgrade`、`start` 看不到它的結果；root 的清理或遷移放 `root.start`，非特權的收尾放 `dsm-scripts/`。宣告 `root.start` 會改變 policy digest，需要管理員重新核准；沒有宣告的 App policy 不變。需要 SDK 0.10.3 以上。
+start、stop 步驟與 `uninstall.purge.root` 都以 root、無 session 執行，只在管理員核准有效時跑；這些程式不能宣告 run 或 job（session 要用時以另一個名稱設定，可指向同一份內容）。start 步驟在新版本第一次啟動、executor 開 socket 並回讀核准任務之後執行，最多 60 秒；執行期間 executor 只回應 `status`（`state: "starting"`），其他請求回可重試的 `EXECUTOR_STARTING`，DSM 視窗的核准會等它結束，狀態讀取則立即回 `executor_starting`、由 SDK 面板自行重試，失敗只寫進 executor log，不擋啟動；同一版本不重跑，程式要能重複執行。結果由 executor `status` 的 `start_step` 讀取（`pending`、`ok`、`failed`，含 exit 與 output）。DSM 的 start 只寫入要求就返回，所以 `dsm-scripts/postinst`、`postupgrade`、`start` 看不到它的結果；root 的清理或遷移放 `root.start`，非特權的收尾放 `dsm-scripts/`。宣告 `root.start` 會改變 policy digest，需要管理員重新核准；沒有宣告的 App policy 不變。需要 SDK 0.10.3 以上。
 
 schema 是 executor 的封閉子集（每個 object 都要 `additionalProperties: false`，key `[a-z0-9_]`，pattern 為 RE2）。這些設定需要支援它們的 SDK executor（`EXECUTOR_ROOT_PROGRAMS_UNSUPPORTED`）。preupgrade 呼叫 `executor/lifecycle stop --upgrade`；舊 SDK 的 helper 不認得此旗標時改用一般 stop。