@synopackageland/cli 0.4.0 → 0.4.1

package/dist/standalone/manifest.js

@@ -5,6 +5,7 @@ import { isNativeArchFamily } from "../build-spk/dsm-arch.js";
 import { checkGlossary, isLocale, loadCatalogs } from "./i18n.js";
 import { loadRootOps, ROOT_OPS_DIR } from "./root-ops.js";
 import { readIntegration } from "./helper.js";
+import { readDaemon } from "./daemon.js";
 /**
  * `dsm-package.yaml`: a Standalone Package, i.e. an unsigned native SPK that
  * runs as its own DSM package account with a CGI backend and a DSM window UI.
@@ -12,7 +13,7 @@ import { readIntegration } from "./helper.js";
 export const STANDALONE_MANIFEST = "dsm-package.yaml";
 const KNOWN_FIELDS = new Set([
     "schema", "package", "version", "build", "displayname", "description",
-    "maintainer", "os_min_ver", "arches", "backend", "ui", "privilege", "i18n", "integration",
+    "maintainer", "os_min_ver", "arches", "backend", "ui", "privilege", "i18n", "integration", "daemon",
 ]);
 const I18N_FIELDS = new Set(["messages", "glossary", "info"]);
 const INFO_TEXT_FIELDS = new Set(["displayname", "description"]);
@@ -102,6 +103,7 @@ function readManifest(raw, c) {
     const maintainer = c.text(raw.maintainer, "maintainer");
     const arches = readArches(raw.arches, c);
     const backend = arches && readBackend(raw.backend, arches, c);
+    const daemon = arches && readDaemon(raw.daemon, c.root, arches, e => c.fail(e.code, e.message));
     const integration = readIntegration(raw.integration, c.root, e => c.fail(e.code, e.message));
     if (integration && (privilege !== "root" || backend?.kind !== "go" || rootOps?.some(op => op.name.startsWith("helper_")))) {
         c.fail("STANDALONE_INTEGRATION_INVALID", "integration 需要 privilege: root 和 backend.go；helper_ 操作名稱保留給 generator。");
@@ -129,6 +131,7 @@ function readManifest(raw, c) {
         privilege,
         ...(rootOps ? { rootOps } : {}),
         ...(integration ? { integration } : {}),
+        ...(daemon ? { daemon } : {}),
     };
 }
 function readRootOps(privilege, c) {

package/dist/standalone/reopen-events.d.ts

@@ -0,0 +1,2 @@
+/** Wrapper-owned subscriptions; no dependency on native event names or Ext. */
+export declare const REOPEN_EVENTS_RUNTIME = "\nfunction createReopenEvents() {\n  var active = true, handlers = [];\n  function subscribe(fn) {\n    if (!active || typeof fn !== \"function\") return function () {};\n    function handler() { if (active && fn) fn(); }\n    function unsubscribe() {\n      if (!fn) return;\n      fn = null;\n      var index = handlers.indexOf(handler);\n      if (index !== -1) handlers.splice(index, 1);\n    }\n    handler.unsubscribe = unsubscribe;\n    handlers.push(handler);\n    return unsubscribe;\n  }\n  return {\n    handlers: handlers,\n    subscribe: subscribe,\n    emit: function () { handlers.slice().forEach(function (handler) { handler(); }); },\n    dispose: function () {\n      active = false;\n      handlers.slice().forEach(function (handler) { handler.unsubscribe(); });\n    }\n  };\n}\n";

package/dist/standalone/reopen-events.js

@@ -0,0 +1,28 @@
+/** Wrapper-owned subscriptions; no dependency on native event names or Ext. */
+export const REOPEN_EVENTS_RUNTIME = `
+function createReopenEvents() {
+  var active = true, handlers = [];
+  function subscribe(fn) {
+    if (!active || typeof fn !== "function") return function () {};
+    function handler() { if (active && fn) fn(); }
+    function unsubscribe() {
+      if (!fn) return;
+      fn = null;
+      var index = handlers.indexOf(handler);
+      if (index !== -1) handlers.splice(index, 1);
+    }
+    handler.unsubscribe = unsubscribe;
+    handlers.push(handler);
+    return unsubscribe;
+  }
+  return {
+    handlers: handlers,
+    subscribe: subscribe,
+    emit: function () { handlers.slice().forEach(function (handler) { handler(); }); },
+    dispose: function () {
+      active = false;
+      handlers.slice().forEach(function (handler) { handler.unsubscribe(); });
+    }
+  };
+}
+`;

package/dist/standalone/root-messages.js

@@ -25,6 +25,7 @@ export const ROOT_MESSAGES = {
         admin_only: "Only administrator accounts can perform this operation.",
         uninstall_hint: "Before uninstalling this package, click Remove to delete its task from Task Scheduler.",
         "error.root_conflict": "Rename or delete the task \"{name}\" in Task Scheduler, then click Retry.",
+        "error.root_cancelled": "Password confirmation was cancelled. No operation was run.",
         "error.root_not_ready": "Authorize this operation first.",
         "error.root_task_failed": "The task ended with an error. Check its history in Task Scheduler, then click Retry.",
         "error.root_timeout": "The task did not finish in time. Check it in Task Scheduler, then click Retry.",
@@ -52,6 +53,7 @@ export const ROOT_MESSAGES = {
         admin_only: "僅限管理員帳號允許執行此操作。",
         uninstall_hint: "解除安裝此套件前，請按「移除」從任務排程表刪除它的任務。",
         "error.root_conflict": "請在任務排程表中重新命名或刪除任務「{name}」，再按「重試」。",
+        "error.root_cancelled": "已取消密碼確認，未執行任何操作。",
         "error.root_not_ready": "請先授權此操作。",
         "error.root_task_failed": "任務執行失敗。請在任務排程表查看其記錄，再按「重試」。",
         "error.root_timeout": "任務未在時限內完成。請在任務排程表確認後，再按「重試」。",
@@ -79,6 +81,7 @@ export const ROOT_MESSAGES = {
         admin_only: "只有管理员帐户才能执行此操作。",
         uninstall_hint: "卸载此套件前，请单击“删除”从任务计划中删除它的任务。",
         "error.root_conflict": "请在任务计划中重命名或删除任务“{name}”，然后单击“重试”。",
+        "error.root_cancelled": "已取消密码确认，未执行任何操作。",
         "error.root_not_ready": "请先授权此操作。",
         "error.root_task_failed": "任务运行失败。请在任务计划中查看其记录，然后单击“重试”。",
         "error.root_timeout": "任务未在时限内完成。请在任务计划中确认后单击“重试”。",
@@ -106,6 +109,7 @@ export const ROOT_MESSAGES = {
         admin_only: "この操作を実行できるのは管理者アカウントのみです。",
         uninstall_hint: "このパッケージをアンインストールする前に、「削除」をクリックしてタスク スケジューラーからタスクを削除してください。",
         "error.root_conflict": "タスク スケジューラーでタスク「{name}」の名前を変更するか削除してから、「再試行」をクリックしてください。",
+        "error.root_cancelled": "パスワードの確認がキャンセルされました。操作は実行されていません。",
         "error.root_not_ready": "先にこの操作を承認してください。",
         "error.root_task_failed": "タスクがエラーで終了しました。タスク スケジューラーで履歴を確認してから、「再試行」をクリックしてください。",
         "error.root_timeout": "タスクが時間内に完了しませんでした。タスク スケジューラーで確認してから、「再試行」をクリックしてください。",
@@ -133,6 +137,7 @@ export const ROOT_MESSAGES = {
         admin_only: "관리자 계정에서만 이 작업을 수행할 수 있습니다.",
         uninstall_hint: "이 패키지를 제거하기 전에 \"제거\"를 클릭하여 작업 스케줄러에서 작업을 삭제하십시오.",
         "error.root_conflict": "작업 스케줄러에서 작업 \"{name}\"의 이름을 바꾸거나 삭제한 후 \"재시도\"를 클릭하십시오.",
+        "error.root_cancelled": "비밀번호 확인이 취소되었습니다. 작업이 실행되지 않았습니다.",
         "error.root_not_ready": "먼저 이 작업을 승인하십시오.",
         "error.root_task_failed": "작업이 오류로 종료되었습니다. 작업 스케줄러에서 기록을 확인한 후 \"재시도\"를 클릭하십시오.",
         "error.root_timeout": "작업이 제시간에 완료되지 않았습니다. 작업 스케줄러에서 확인한 후 \"재시도\"를 클릭하십시오.",
@@ -160,6 +165,7 @@ export const ROOT_MESSAGES = {
         admin_only: "Nur Administratorkonten können diesen Vorgang ausführen.",
         uninstall_hint: "Klicken Sie vor der Deinstallation dieses Pakets auf „Entfernen“, um seine Aufgabe aus dem Aufgabenplaner zu löschen.",
         "error.root_conflict": "Benennen Sie die Aufgabe „{name}“ im Aufgabenplaner um oder löschen Sie sie, und klicken Sie dann auf „Neuer Versuch“.",
+        "error.root_cancelled": "Die Passwortbestätigung wurde abgebrochen. Es wurde keine Aktion ausgeführt.",
         "error.root_not_ready": "Geben Sie diesen Vorgang zuerst frei.",
         "error.root_task_failed": "Die Aufgabe wurde mit einem Fehler beendet. Prüfen Sie ihren Verlauf im Aufgabenplaner, und klicken Sie dann auf „Neuer Versuch“.",
         "error.root_timeout": "Die Aufgabe wurde nicht rechtzeitig beendet. Prüfen Sie sie im Aufgabenplaner, und klicken Sie dann auf „Neuer Versuch“.",
@@ -187,6 +193,7 @@ export const ROOT_MESSAGES = {
         admin_only: "Seuls les comptes administrateur peuvent effectuer cette opération.",
         uninstall_hint: "Avant de désinstaller ce paquet, cliquez sur « Supprimer » pour retirer sa tâche du Planificateur de tâches.",
         "error.root_conflict": "Renommez ou supprimez la tâche « {name} » dans le Planificateur de tâches, puis cliquez sur « Réessayer ».",
+        "error.root_cancelled": "La confirmation du mot de passe a été annulée. Aucune opération n’a été exécutée.",
         "error.root_not_ready": "Autorisez d'abord cette opération.",
         "error.root_task_failed": "La tâche s'est terminée avec une erreur. Consultez son historique dans le Planificateur de tâches, puis cliquez sur « Réessayer ».",
         "error.root_timeout": "La tâche ne s'est pas terminée à temps. Vérifiez-la dans le Planificateur de tâches, puis cliquez sur « Réessayer ».",
@@ -214,6 +221,7 @@ export const ROOT_MESSAGES = {
         admin_only: "Solo las cuentas de administrador pueden realizar esta operación.",
         uninstall_hint: "Antes de desinstalar este paquete, haga clic en «Quitar» para eliminar su tarea del Programador de tareas.",
         "error.root_conflict": "Cambie el nombre de la tarea «{name}» o elimínela en el Programador de tareas y, a continuación, haga clic en «Volver a intentar».",
+        "error.root_cancelled": "Se canceló la confirmación de la contraseña. No se ejecutó ninguna operación.",
         "error.root_not_ready": "Primero autorice esta operación.",
         "error.root_task_failed": "La tarea terminó con un error. Consulte su historial en el Programador de tareas y, a continuación, haga clic en «Volver a intentar».",
         "error.root_timeout": "La tarea no terminó a tiempo. Revísela en el Programador de tareas y, a continuación, haga clic en «Volver a intentar».",
@@ -241,6 +249,7 @@ export const ROOT_MESSAGES = {
         admin_only: "Solo gli account administrator possono eseguire questa operazione.",
         uninstall_hint: "Prima di disinstallare questo pacchetto, fare clic su \"Rimuovi\" per eliminare la sua attività da Utilità di pianificazione.",
         "error.root_conflict": "Rinominare o eliminare l'attività \"{name}\" in Utilità di pianificazione, quindi fare clic su \"Riprova\".",
+        "error.root_cancelled": "La conferma della password è stata annullata. Nessuna operazione è stata eseguita.",
         "error.root_not_ready": "Autorizzare prima questa operazione.",
         "error.root_task_failed": "L'attività è terminata con un errore. Controllarne la cronologia in Utilità di pianificazione, quindi fare clic su \"Riprova\".",
         "error.root_timeout": "L'attività non è terminata in tempo. Controllarla in Utilità di pianificazione, quindi fare clic su \"Riprova\".",

package/dist/standalone/root-window.d.ts

@@ -20,16 +20,17 @@ export declare function rootTasks(manifest: {
  *   with exactly the embedded script. The one-use token goes into that single
  *   create call and is never kept.
  * - run: re-reads the task and runs it only if it is still exactly ours, then
- *   waits for its history entry and asks the backend for the output.
+ *   waits for its history entry and asks the backend for the output. Repair
+ *   additionally requires fresh PasswordConfirm and another exact task check.
  * - an older version of our task is "outdated" and never runs; authorizing
  *   again replaces it. A same-named task that is not ours is a "conflict" and
  *   is never run, replaced or deleted.
  */
-export declare const ROOT_RUNTIME = "function createRootAccess(options) {\n  var API = \"SYNO.Core.TaskScheduler\";\n  var POLL_MS = 500, POLLS = 60;\n  var byOp = {};\n  options.tasks.forEach(function (task) { byOp[task.op] = task; });\n\n  function fail(code) {\n    var error = new Error(code);\n    error.code = code;\n    return error;\n  }\n  function begin(op) {\n    if (!Object.prototype.hasOwnProperty.call(byOp, op)) return Promise.reject(fail(\"root_unknown_op\"));\n    if (options.user().admin !== true) return Promise.reject(fail(\"admin_required\"));\n    return Promise.resolve(byOp[op]);\n  }\n  function isRootTask(summary) {\n    return summary.owner === \"root\" && summary.real_owner === \"root\" && summary.enable === false && summary.type === \"script\";\n  }\n  function find(task) {\n    return options.send(API, \"list\", 3, { start: 0, limit: 500 }).then(function (data) {\n      if (!data || !Array.isArray(data.tasks)) throw fail(\"root_bad_response\");\n      var named = data.tasks.filter(function (summary) { return summary && summary.name === task.name; });\n      if (named.length === 0) return { state: \"missing\" };\n      if (named.length > 1 || !isRootTask(named[0])) return { state: \"conflict\" };\n      var ref = { id: named[0].id, real_owner: named[0].real_owner };\n      return options.send(API, \"get\", 4, ref).then(function (detail) {\n        var script = detail && detail.extra && detail.extra.script;\n        if (!detail || String(detail.id) !== String(ref.id) || detail.name !== task.name\n            || detail.owner !== \"root\" || detail.enable !== false || detail.type !== \"script\" || typeof script !== \"string\") {\n          return { state: \"conflict\" };\n        }\n        if (script === task.script) return { state: \"ready\", ref: ref };\n        if (script.indexOf(task.header) === 0) return { state: \"outdated\", ref: ref };\n        return { state: \"conflict\" };\n      });\n    });\n  }\n  function definition(task, user) {\n    var hours = [];\n    for (var h = 1; h <= 23; h++) hours.push(h);\n    return {\n      name: task.name,\n      real_owner: user,\n      owner: \"root\",\n      enable: false,\n      type: \"script\",\n      schedule: {\n        date_type: 0, week_day: \"0,1,2,3,4,5,6\", repeat_date: 1001, monthly_week: [], hour: 0, minute: 0,\n        repeat_hour: 0, repeat_min: 0, last_work_hour: 0,\n        repeat_min_store_config: [1, 5, 10, 15, 20, 30], repeat_hour_store_config: hours\n      },\n      extra: { notify_enable: false, script: task.script, notify_mail: \"\", notify_if_error: false }\n    };\n  }\n  function newest(history) {\n    if (!Array.isArray(history)) throw fail(\"root_bad_response\");\n    return history.reduce(function (latest, entry) {\n      return entry && (!latest || Number(entry.timestamp) > Number(latest.timestamp)) ? entry : latest;\n    }, null);\n  }\n  function history(ref) {\n    return options.send(API, \"get_history_status_list\", 1, { id: ref.id }).then(newest);\n  }\n  function waitForRun(ref, before, polls) {\n    return history(ref).then(function (latest) {\n      var finished = latest && (!before || latest.timestamp !== before.timestamp)\n        && latest.exit_type !== \"running\" && latest.stop_time;\n      if (finished) {\n        if (latest.exit_code !== 0) throw fail(\"root_task_failed\");\n        return;\n      }\n      if (polls <= 1) throw fail(\"root_timeout\");\n      return options.wait(POLL_MS).then(function () { return waitForRun(ref, before, polls - 1); });\n    });\n  }\n\n  return {\n    state: function (op) {\n      return begin(op).then(find).then(function (found) { return found.state; });\n    },\n    authorize: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state === \"ready\") return \"ready\";\n          if (found.state === \"conflict\") throw fail(\"root_conflict\");\n          return options.confirmPassword().then(function (token) {\n            if (!token) return \"cancelled\";\n            var params = definition(task, options.user().name);\n            params.SynoConfirmPWToken = token;\n            var replaced = found.state === \"outdated\"\n              ? options.send(API, \"delete\", 2, { tasks: [found.ref] })\n              : Promise.resolve();\n            return replaced.then(function () {\n              return options.send(API + \".Root\", \"create\", 4, params);\n            }).then(function () {\n              return find(task);\n            }).then(function (after) {\n              if (after.state !== \"ready\") throw fail(\"root_verify_failed\");\n              return \"ready\";\n            });\n          });\n        });\n      });\n    },\n    run: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state !== \"ready\") throw fail(\"root_not_ready\");\n          return history(found.ref).then(function (before) {\n            return options.send(API, \"run\", 2, { tasks: [found.ref] }).then(function () {\n              return waitForRun(found.ref, before, POLLS);\n            });\n          });\n        }).then(function () {\n          return options.call(\"root.output\", { op: op });\n        });\n      });\n    },\n    remove: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state === \"missing\") return \"missing\";\n          if (found.state === \"conflict\") throw fail(\"root_conflict\");\n          return options.send(API, \"delete\", 2, { tasks: [found.ref] }).then(function () {\n            return find(task);\n          }).then(function (after) {\n            if (after.state !== \"missing\") throw fail(\"root_verify_failed\");\n            return \"missing\";\n          });\n        });\n      });\n    },\n    output: function (op) {\n      return begin(op).then(function () {\n        return options.call(\"root.output\", { op: op });\n      });\n    }\n  };\n}";
+export declare const ROOT_RUNTIME = "function createRootAccess(options) {\n  var API = \"SYNO.Core.TaskScheduler\";\n  var POLL_MS = 500, POLLS = 60;\n  var byOp = {};\n  options.tasks.forEach(function (task) { byOp[task.op] = task; });\n\n  function fail(code) {\n    var error = new Error(code);\n    error.code = code;\n    return error;\n  }\n  function begin(op) {\n    if (!Object.prototype.hasOwnProperty.call(byOp, op)) return Promise.reject(fail(\"root_unknown_op\"));\n    if (options.user().admin !== true) return Promise.reject(fail(\"admin_required\"));\n    return Promise.resolve(byOp[op]);\n  }\n  function isRootTask(summary) {\n    return summary.owner === \"root\" && summary.real_owner === \"root\" && summary.enable === false && summary.type === \"script\";\n  }\n  function find(task) {\n    return options.send(API, \"list\", 3, { start: 0, limit: 500 }).then(function (data) {\n      if (!data || !Array.isArray(data.tasks)) throw fail(\"root_bad_response\");\n      var named = data.tasks.filter(function (summary) { return summary && summary.name === task.name; });\n      if (named.length === 0) return { state: \"missing\" };\n      if (named.length > 1 || !isRootTask(named[0])) return { state: \"conflict\" };\n      var ref = { id: named[0].id, real_owner: named[0].real_owner };\n      return options.send(API, \"get\", 4, ref).then(function (detail) {\n        var script = detail && detail.extra && detail.extra.script;\n        if (!detail || String(detail.id) !== String(ref.id) || detail.name !== task.name\n            || detail.owner !== \"root\" || detail.enable !== false || detail.type !== \"script\" || typeof script !== \"string\") {\n          return { state: \"conflict\" };\n        }\n        if (script === task.script) return { state: \"ready\", ref: ref };\n        if (script.indexOf(task.header) === 0) return { state: \"outdated\", ref: ref };\n        return { state: \"conflict\" };\n      });\n    });\n  }\n  function definition(task, user) {\n    var hours = [];\n    for (var h = 1; h <= 23; h++) hours.push(h);\n    return {\n      name: task.name,\n      real_owner: user,\n      owner: \"root\",\n      enable: false,\n      type: \"script\",\n      schedule: {\n        date_type: 0, week_day: \"0,1,2,3,4,5,6\", repeat_date: 1001, monthly_week: [], hour: 0, minute: 0,\n        repeat_hour: 0, repeat_min: 0, last_work_hour: 0,\n        repeat_min_store_config: [1, 5, 10, 15, 20, 30], repeat_hour_store_config: hours\n      },\n      extra: { notify_enable: false, script: task.script, notify_mail: \"\", notify_if_error: false }\n    };\n  }\n  function newest(history) {\n    if (!Array.isArray(history)) throw fail(\"root_bad_response\");\n    return history.reduce(function (latest, entry) {\n      return entry && (!latest || Number(entry.timestamp) > Number(latest.timestamp)) ? entry : latest;\n    }, null);\n  }\n  function history(ref) {\n    return options.send(API, \"get_history_status_list\", 1, { id: ref.id }).then(newest);\n  }\n  function waitForRun(ref, before, polls) {\n    return history(ref).then(function (latest) {\n      var finished = latest && (!before || latest.timestamp !== before.timestamp)\n        && latest.exit_type !== \"running\" && latest.stop_time;\n      if (finished) {\n        if (latest.exit_code !== 0) throw fail(\"root_task_failed\");\n        return;\n      }\n      if (polls <= 1) throw fail(\"root_timeout\");\n      return options.wait(POLL_MS).then(function () { return waitForRun(ref, before, polls - 1); });\n    });\n  }\n\n  return {\n    state: function (op) {\n      return begin(op).then(find).then(function (found) { return found.state; });\n    },\n    authorize: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state === \"ready\") return \"ready\";\n          if (found.state === \"conflict\") throw fail(\"root_conflict\");\n          return options.confirmPassword().then(function (token) {\n            if (!token) return \"cancelled\";\n            var params = definition(task, options.user().name);\n            params.SynoConfirmPWToken = token;\n            var replaced = found.state === \"outdated\"\n              ? options.send(API, \"delete\", 2, { tasks: [found.ref] })\n              : Promise.resolve();\n            return replaced.then(function () {\n              return options.send(API + \".Root\", \"create\", 4, params);\n            }).then(function () {\n              return find(task);\n            }).then(function (after) {\n              if (after.state !== \"ready\") throw fail(\"root_verify_failed\");\n              return \"ready\";\n            });\n          });\n        });\n      });\n    },\n    run: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state !== \"ready\") throw fail(\"root_not_ready\");\n          // Repair requires fresh interactive consent even for a retained task.\n          // Confirmation tokens are never cached or reused as scheduler tokens.\n          var consent = op === \"helper_repair\" ? options.confirmPassword() : Promise.resolve(true);\n          return consent.then(function (token) {\n            if (!token) throw fail(\"root_cancelled\");\n            // The user may leave the dialog open while the scheduler changes.\n            return op === \"helper_repair\" ? begin(op).then(find) : found;\n          }).then(function (verified) {\n            if (verified.state !== \"ready\") throw fail(\"root_not_ready\");\n            return history(verified.ref).then(function (before) {\n              return options.send(API, \"run\", 2, { tasks: [verified.ref] }).then(function () {\n                return waitForRun(verified.ref, before, POLLS);\n              });\n            });\n          });\n        }).then(function () {\n          return options.call(\"root.output\", { op: op });\n        });\n      });\n    },\n    remove: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state === \"missing\") return \"missing\";\n          if (found.state === \"conflict\") throw fail(\"root_conflict\");\n          return options.send(API, \"delete\", 2, { tasks: [found.ref] }).then(function () {\n            return find(task);\n          }).then(function (after) {\n            if (after.state !== \"missing\") throw fail(\"root_verify_failed\");\n            return \"missing\";\n          });\n        });\n      });\n    },\n    output: function (op) {\n      return begin(op).then(function () {\n        return options.call(\"root.output\", { op: op });\n      });\n    }\n  };\n}";
 /**
  * The authorization panel the window shows above the app for each root
  * operation, identical in every package. `rootPanelView(model)` decides what
  * it shows; `mountRootPanel(host, access, i18n, tasks, admin)` draws it with
  * DOM text nodes only (no HTML from data).
  */
-export declare const ROOT_PANEL = "function rootPanelShowsResult(state) {\n  return state === \"ready\" || state === \"outdated\";\n}\n\nfunction rootPanelView(model) {\n  if (!model.admin) return { status: null, buttons: [], message: { key: \"admin_only\" } };\n  function buttons(actions) {\n    return actions.map(function (action) { return { action: action, disabled: model.busy === true }; });\n  }\n  if (model.error) {\n    return {\n      status: \"state.\" + model.state, buttons: buttons([\"retry\"]),\n      message: { key: \"error.\" + model.error, params: { name: model.name, code: model.error } }\n    };\n  }\n  var message = model.notice ? { key: model.notice } : null;\n  switch (model.state) {\n    case \"missing\":\n      return { status: \"state.missing\", buttons: buttons([\"authorize\"]), message: message };\n    case \"outdated\":\n      return { status: \"state.outdated\", buttons: buttons([\"authorize\", \"remove\"]), message: message };\n    case \"ready\":\n      return { status: \"state.ready\", buttons: buttons([\"run\", \"remove\"]), message: message };\n    case \"conflict\":\n      return { status: \"state.conflict\", buttons: buttons([\"retry\"]), message: { key: \"error.root_conflict\", params: { name: model.name } } };\n    default:\n      return { status: \"state.checking\", buttons: [], message: null };\n  }\n}\n\nfunction mountRootPanel(host, access, i18n, tasks, admin) {\n  var t = i18n.t;\n  function el(tag, className, text) {\n    var node = document.createElement(tag);\n    if (className) node.className = className;\n    if (text !== undefined) node.textContent = text;\n    return node;\n  }\n  function say(message) {\n    if (!message) return \"\";\n    var text = t(message.key, message.params);\n    return text === message.key && message.key.indexOf(\"error.\") === 0 ? t(\"error.default\", message.params) : text;\n  }\n  tasks.forEach(function (task) {\n    var model = { admin: admin, name: task.name, state: \"checking\", busy: false, error: null, notice: null };\n    var result = null;\n    var section = el(\"section\", \"dsmapp-rootpanel\");\n    host.appendChild(section);\n\n    function render() {\n      var view = rootPanelView(model);\n      while (section.firstChild) section.removeChild(section.firstChild);\n      section.appendChild(el(\"h2\", null, t(\"title\")));\n      section.appendChild(el(\"p\", null, t(\"intro\", { op: task.op })));\n      if (view.status) {\n        var facts = el(\"dl\");\n        facts.appendChild(el(\"dt\", null, t(\"status\")));\n        facts.appendChild(el(\"dd\", \"dsmapp-rootpanel-state\", t(view.status, { name: task.name })));\n        facts.appendChild(el(\"dt\", null, t(\"last_run\")));\n        facts.appendChild(el(\"dd\", null, result && result.modified\n          ? new Date(result.modified * 1000).toLocaleString(i18n.locale) : t(\"never\")));\n        section.appendChild(facts);\n      }\n      if (view.message) section.appendChild(el(\"p\", \"dsmapp-rootpanel-message\", say(view.message)));\n      if (result && typeof result.output === \"string\") {\n        section.appendChild(el(\"div\", \"dsmapp-rootpanel-label\", t(\"output\")));\n        section.appendChild(el(\"pre\", \"dsmapp-rootpanel-output\", result.output));\n      }\n      var actions = el(\"div\", \"dsmapp-rootpanel-actions\");\n      view.buttons.forEach(function (button) {\n        var node = el(\"button\", button.action === \"remove\" ? null : \"dsmapp-rootpanel-primary\", t(button.action));\n        node.type = \"button\";\n        node.disabled = button.disabled;\n        node.onclick = function () { act(button.action); };\n        actions.appendChild(node);\n      });\n      section.appendChild(actions);\n      if (admin && rootPanelShowsResult(model.state)) section.appendChild(el(\"p\", \"dsmapp-rootpanel-hint\", t(\"uninstall_hint\")));\n    }\n    function settle(promise, notice) {\n      model.busy = true;\n      model.error = null;\n      model.notice = null;\n      render();\n      return promise.then(function (value) {\n        model.notice = typeof notice === \"function\" ? notice(value) : notice;\n      }, function (error) {\n        model.error = (error && error.code) || \"unknown\";\n      }).then(function () {\n        model.busy = false;\n        render();\n      });\n    }\n    function refresh(notice) {\n      return settle(access.state(task.op).then(function (state) {\n        model.state = state;\n        if (!rootPanelShowsResult(state)) return;\n        return access.output(task.op).then(function (out) { result = out; });\n      }), notice);\n    }\n    function refreshAfterChange() {\n      return model.error ? null : refresh(model.notice);\n    }\n    function act(action) {\n      if (action === \"retry\") return refresh(null);\n      if (action === \"authorize\") {\n        return settle(access.authorize(task.op), function (outcome) {\n          return outcome === \"cancelled\" ? \"cancelled\" : null;\n        }).then(refreshAfterChange);\n      }\n      if (action === \"run\") {\n        return settle(access.run(task.op).then(function (out) { result = out; }), \"completed\");\n      }\n      if (action === \"remove\") {\n        return settle(access.remove(task.op).then(function () { result = null; }), null).then(refreshAfterChange);\n      }\n    }\n    render();\n    if (admin) refresh(null);\n  });\n}";
+export declare const ROOT_PANEL = "function rootPanelShowsResult(state) {\n  return state === \"ready\" || state === \"outdated\";\n}\n\nfunction rootPanelView(model) {\n  if (!model.admin) return { status: null, buttons: [], message: { key: \"admin_only\" } };\n  function buttons(actions) {\n    return actions.map(function (action) { return { action: action, disabled: model.busy === true }; });\n  }\n  if (model.error) {\n    return {\n      status: \"state.\" + model.state, buttons: buttons([\"retry\"]),\n      message: { key: \"error.\" + model.error, params: { name: model.name, code: model.error } }\n    };\n  }\n  var message = model.notice ? { key: model.notice } : null;\n  switch (model.state) {\n    case \"missing\":\n      return { status: \"state.missing\", buttons: buttons([\"authorize\"]), message: message };\n    case \"outdated\":\n      return { status: \"state.outdated\", buttons: buttons([\"authorize\", \"remove\"]), message: message };\n    case \"ready\":\n      return { status: \"state.ready\", buttons: buttons([\"run\", \"remove\"]), message: message };\n    case \"conflict\":\n      return { status: \"state.conflict\", buttons: buttons([\"retry\"]), message: { key: \"error.root_conflict\", params: { name: model.name } } };\n    default:\n      return { status: \"state.checking\", buttons: [], message: null };\n  }\n}\n\nfunction mountRootPanel(host, access, i18n, tasks, admin) {\n  var t = i18n.t;\n  function el(tag, className, text) {\n    var node = document.createElement(tag);\n    if (className) node.className = className;\n    if (text !== undefined) node.textContent = text;\n    return node;\n  }\n  function say(message) {\n    if (!message) return \"\";\n    var text = t(message.key, message.params);\n    return text === message.key && message.key.indexOf(\"error.\") === 0 ? t(\"error.default\", message.params) : text;\n  }\n  tasks.forEach(function (task) {\n    var model = { admin: admin, name: task.name, state: \"checking\", busy: false, error: null, notice: null };\n    var result = null;\n    var section = el(\"section\", \"dsmapp-rootpanel\");\n    host.appendChild(section);\n\n    function render() {\n      var view = rootPanelView(model);\n      while (section.firstChild) section.removeChild(section.firstChild);\n      section.appendChild(el(\"h2\", null, t(\"title\")));\n      section.appendChild(el(\"p\", null, t(\"intro\", { op: task.op })));\n      if (view.status) {\n        var facts = el(\"dl\");\n        facts.appendChild(el(\"dt\", null, t(\"status\")));\n        facts.appendChild(el(\"dd\", \"dsmapp-rootpanel-state\", t(view.status, { name: task.name })));\n        facts.appendChild(el(\"dt\", null, t(\"last_run\")));\n        facts.appendChild(el(\"dd\", null, result && result.modified\n          ? new Date(result.modified * 1000).toLocaleString(i18n.locale) : t(\"never\")));\n        section.appendChild(facts);\n      }\n      if (view.message) section.appendChild(el(\"p\", \"dsmapp-rootpanel-message\", say(view.message)));\n      if (result && typeof result.output === \"string\") {\n        section.appendChild(el(\"div\", \"dsmapp-rootpanel-label\", t(\"output\")));\n        section.appendChild(el(\"pre\", \"dsmapp-rootpanel-output\", result.output));\n      }\n      var actions = el(\"div\", \"dsmapp-rootpanel-actions\");\n      view.buttons.forEach(function (button) {\n        var node = el(\"button\", button.action === \"remove\" ? null : \"dsmapp-rootpanel-primary\", t(button.action));\n        node.type = \"button\";\n        node.disabled = button.disabled;\n        node.onclick = function () { act(button.action); };\n        actions.appendChild(node);\n      });\n      section.appendChild(actions);\n      if (admin && rootPanelShowsResult(model.state)) section.appendChild(el(\"p\", \"dsmapp-rootpanel-hint\", t(\"uninstall_hint\")));\n    }\n    function settle(promise, notice) {\n      model.busy = true;\n      model.error = null;\n      model.notice = null;\n      render();\n      return promise.then(function (value) {\n        model.notice = typeof notice === \"function\" ? notice(value) : notice;\n      }, function (error) {\n        if (error && error.code === \"root_cancelled\") model.notice = \"cancelled\";\n        else model.error = (error && error.code) || \"unknown\";\n      }).then(function () {\n        model.busy = false;\n        render();\n      });\n    }\n    function refresh(notice) {\n      return settle(access.state(task.op).then(function (state) {\n        model.state = state;\n        if (!rootPanelShowsResult(state)) return;\n        return access.output(task.op).then(function (out) { result = out; });\n      }), notice);\n    }\n    function refreshAfterChange() {\n      return model.error ? null : refresh(model.notice);\n    }\n    function act(action) {\n      if (action === \"retry\") return refresh(null);\n      if (action === \"authorize\") {\n        return settle(access.authorize(task.op), function (outcome) {\n          return outcome === \"cancelled\" ? \"cancelled\" : null;\n        }).then(refreshAfterChange);\n      }\n      if (action === \"run\") {\n        return settle(access.run(task.op).then(function (out) { result = out; }), \"completed\");\n      }\n      if (action === \"remove\") {\n        return settle(access.remove(task.op).then(function () { result = null; }), null).then(refreshAfterChange);\n      }\n    }\n    render();\n    if (admin) refresh(null);\n  });\n}";

package/dist/standalone/root-window.js

@@ -16,7 +16,8 @@ export function rootTasks(manifest) {
  *   with exactly the embedded script. The one-use token goes into that single
  *   create call and is never kept.
  * - run: re-reads the task and runs it only if it is still exactly ours, then
- *   waits for its history entry and asks the backend for the output.
+ *   waits for its history entry and asks the backend for the output. Repair
+ *   additionally requires fresh PasswordConfirm and another exact task check.
  * - an older version of our task is "outdated" and never runs; authorizing
  *   again replaces it. A same-named task that is not ours is a "conflict" and
  *   is never run, replaced or deleted.
@@ -130,9 +131,19 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       return begin(op).then(function (task) {
         return find(task).then(function (found) {
           if (found.state !== "ready") throw fail("root_not_ready");
-          return history(found.ref).then(function (before) {
-            return options.send(API, "run", 2, { tasks: [found.ref] }).then(function () {
-              return waitForRun(found.ref, before, POLLS);
+          // Repair requires fresh interactive consent even for a retained task.
+          // Confirmation tokens are never cached or reused as scheduler tokens.
+          var consent = op === "helper_repair" ? options.confirmPassword() : Promise.resolve(true);
+          return consent.then(function (token) {
+            if (!token) throw fail("root_cancelled");
+            // The user may leave the dialog open while the scheduler changes.
+            return op === "helper_repair" ? begin(op).then(find) : found;
+          }).then(function (verified) {
+            if (verified.state !== "ready") throw fail("root_not_ready");
+            return history(verified.ref).then(function (before) {
+              return options.send(API, "run", 2, { tasks: [verified.ref] }).then(function () {
+                return waitForRun(verified.ref, before, POLLS);
+              });
             });
           });
         }).then(function () {
@@ -254,7 +265,8 @@ function mountRootPanel(host, access, i18n, tasks, admin) {
       return promise.then(function (value) {
         model.notice = typeof notice === "function" ? notice(value) : notice;
       }, function (error) {
-        model.error = (error && error.code) || "unknown";
+        if (error && error.code === "root_cancelled") model.notice = "cancelled";
+        else model.error = (error && error.code) || "unknown";
       }).then(function () {
         model.busy = false;
         render();

package/dist/standalone/spk.d.ts

@@ -13,10 +13,11 @@ export interface AssembleOptions {
     cgiPath: string;
     outputPath: string;
     helper?: HelperArtifact;
+    daemonControl?: string;
 }
 /**
- * Packs an unsigned Standalone Package SPK. Nothing in it runs as root: the
- * package account owns the payload, lifecycle scripts do nothing, and the
- * only entry point is the CGI DSM runs behind its own login.
+ * Packs an unsigned Standalone Package SPK. DSM runs installation/lifecycle
+ * as the package account, including an optional foreground daemon. Root
+ * integration remains separate and requires explicit administrator approval.
  */
 export declare function assembleStandaloneSpk(options: AssembleOptions): Promise<void>;

package/dist/standalone/spk.js

@@ -6,8 +6,12 @@ import { infoArchValue } from "../build-spk/dsm-arch.js";
 import { writeDsmWindowIcons, writePackageCenterIcons } from "../build-spk/dsm-icons.js";
 import { renderNativePrivilege } from "../build-spk/native-lifecycle.js";
 import { createReproducibleTar } from "../build-spk/reproducible-archive.js";
+import { renderStandaloneScript } from "./lifecycle.js";
 import { DSM_LANGS, LOCALES } from "./i18n.js";
 import { CGI_PAYLOAD_PATH, renderUiConfig, renderWindowScript, windowScriptName } from "./dsm-window.js";
+import { copyStandaloneNotices } from "../build-spk/notices.js";
+import { hostScriptName, renderHostAdapterScript } from "./host-adapter.js";
+import { copyDaemonPayload } from "./daemon.js";
 const FILE_MODE = 0o644;
 const EXEC_MODE = 0o755;
 const MAX_UI_BYTES = 64 * 1024 * 1024;
@@ -28,9 +32,9 @@ export class StandaloneBuildError extends Error {
     }
 }
 /**
- * Packs an unsigned Standalone Package SPK. Nothing in it runs as root: the
- * package account owns the payload, lifecycle scripts do nothing, and the
- * only entry point is the CGI DSM runs behind its own login.
+ * Packs an unsigned Standalone Package SPK. DSM runs installation/lifecycle
+ * as the package account, including an optional foreground daemon. Root
+ * integration remains separate and requires explicit administrator approval.
  */
 export async function assembleStandaloneSpk(options) {
     const { manifest } = options;
@@ -42,17 +46,24 @@ export async function assembleStandaloneSpk(options) {
         const assetVersion = digestTree(appDir).slice(0, 12);
         writeFile(join(uiRoot, "config"), renderUiConfig(manifest));
         writeFile(join(uiRoot, windowScriptName(manifest)), renderWindowScript(manifest, assetVersion));
+        writeFile(join(uiRoot, hostScriptName(manifest.build)), renderHostAdapterScript(manifest.package));
         writeDsmWindowIcons(uiRoot);
         const cgiTarget = join(staging, "package", CGI_PAYLOAD_PATH);
         mkdirSync(dirname(cgiTarget), { recursive: true });
         copyFileSync(options.cgiPath, cgiTarget);
         chmodSync(cgiTarget, EXEC_MODE);
+        if (manifest.daemon) {
+            if (!options.daemonControl)
+                throw new StandaloneBuildError("STANDALONE_DAEMON_ARTIFACT_REQUIRED", "daemon controller artifact required.");
+            copyDaemonPayload(manifest, options.arch, join(staging, "package", "daemon"), options.daemonControl);
+        }
         if (manifest.integration && !options.helper)
             throw new StandaloneBuildError("HELPER_ARTIFACT_REQUIRED", "integration SPK 缺少已建置的 helper inventory。");
         if (options.helper) {
             const dir = join(staging, "package", "integration");
             mkdirSync(dir, { recursive: true });
             copyFileSync(options.helper.binary, join(dir, "helper"));
+            copyFileSync(new URL("../../templates/native-go/backend/THIRD_PARTY_NOTICES.txt", import.meta.url), join(dir, "THIRD_PARTY_NOTICES.txt"));
             chmodSync(join(dir, "helper"), EXEC_MODE);
             writeFile(join(dir, "inventory.json"), JSON.stringify(options.helper.inventory));
             writeFile(join(dir, "workers.json"), JSON.stringify(options.helper.workers.map(({ id, digest }) => ({ id, digest }))));
@@ -71,6 +82,9 @@ export async function assembleStandaloneSpk(options) {
             copyFileSync(source, target);
             chmodSync(target, FILE_MODE);
         }
+        copyStandaloneNotices(manifest.root, manifest.ui.dir, join(staging, 'package'), manifest.backend.kind === 'go' || Boolean(manifest.daemon), Boolean(options.helper), manifest.integration?.identity === 'better-auth', manifest.backend.kind === 'go' ? manifest.backend.dir : undefined);
+        if (manifest.daemon)
+            copyFileSync(new URL('../../templates/_shared/LICENSES/TEMPLATE.txt', import.meta.url), join(staging, 'package', 'LICENSES', 'DAEMON-LICENSE.txt'));
         const packageTgz = join(staging, "package.tgz");
         await createReproducibleTar(join(staging, "package"), packageTgz, { gzip: true });
         rmSync(join(staging, "package"), { recursive: true, force: true });
@@ -80,7 +94,7 @@ export async function assembleStandaloneSpk(options) {
         writeFile(join(staging, "conf", "privilege"), renderNativePrivilege());
         mkdirSync(join(staging, "scripts"));
         for (const name of LIFECYCLE_SCRIPTS) {
-            writeFile(join(staging, "scripts", name), renderScript(name, manifest), EXEC_MODE);
+            writeFile(join(staging, "scripts", name), renderStandaloneScript(name, manifest), EXEC_MODE);
         }
         writePackageCenterIcons(staging);
         mkdirSync(dirname(options.outputPath), { recursive: true });
@@ -113,6 +127,8 @@ function renderInfo(manifest, arch, checksum) {
         ["startable", "yes"],
         ["checksum", checksum],
     ];
+    if (manifest.integration || manifest.daemon)
+        fields.push(["precheckstartstop", "yes"]);
     if (manifest.integration?.identity === "better-auth")
         fields.push(["install_dep_packages", "Node.js_v22"]);
     for (const locale of LOCALES) {
@@ -124,35 +140,6 @@ function renderInfo(manifest, arch, checksum) {
     }
     return fields.map(([key, value]) => `${key}=${quote(value)}\n`).join("");
 }
-/** No lifecycle work: the CGI needs nothing installed, started or cleaned up. */
-function renderScript(name, manifest) {
-    if (manifest.integration && ["preupgrade", "preuninst", "start-stop-status"].includes(name)) {
-        const check = `/var/packages/${manifest.package}/target/integration/helper check-stopped || {
-  echo 'Run the approved helper_teardown or helper_disable operation before stopping, upgrading or uninstalling.' >&2
-  exit 1
-}
-`;
-        if (name !== "start-stop-status")
-            return `#!/bin/sh\n${check}`;
-        return `#!/bin/sh
-case "$1" in
-  start|status) exit 0 ;;
-  stop)
-${check}    ;;
-  *) exit 1 ;;
-esac
-`;
-    }
-    if (name === "start-stop-status") {
-        return `#!/bin/sh
-case "$1" in
-  start|stop|status) exit 0 ;;
-  *) exit 1 ;;
-esac
-`;
-    }
-    return "#!/bin/sh\nexit 0\n";
-}
 function copyUiTree(source, target) {
     for (const entry of ["app.js", "app.css"]) {
         if (!existsSync(join(source, entry))) {

package/dist/template-paths.d.ts

@@ -0,0 +1,2 @@
+/** Both source execution and the published CLI resolve the same bundled templates. */
+export declare function templatesRoot(): string;

package/dist/template-paths.js

@@ -0,0 +1,9 @@
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+/** Both source execution and the published CLI resolve the same bundled templates. */
+export function templatesRoot() {
+    const moduleDir = dirname(fileURLToPath(import.meta.url));
+    const distTemplates = join(moduleDir, "templates");
+    return existsSync(distTemplates) ? distTemplates : join(moduleDir, "..", "templates");
+}

package/dist/templates/_daemon/fixture_linux_test.go

@@ -0,0 +1,15 @@
+//go:build linux
+
+package main
+
+import (
+	"os"
+	"os/exec"
+	"syscall"
+)
+
+func dropFixtureUser(cmd *exec.Cmd) {
+	if os.Geteuid() == 0 {
+		cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 65534, Gid: 65534, Groups: []uint32{65534}}}
+	}
+}

package/dist/templates/_daemon/fixture_other_test.go

@@ -0,0 +1,7 @@
+//go:build !linux
+
+package main
+
+import "os/exec"
+
+func dropFixtureUser(cmd *exec.Cmd) {}

package/dist/templates/_daemon/go.mod

@@ -0,0 +1,3 @@
+module synopkgland-daemon
+
+go 1.24