@synopackageland/cli 0.4.0 → 0.4.1

package/dist/templates/native-go/backend/internal/helper/write_operation_linux.go

@@ -0,0 +1,245 @@
+package helper
+
+import (
+	"context"
+	"io"
+	"net"
+	"os"
+	"time"
+)
+
+type linuxWriteOperation struct {
+	*linuxOperation
+	writeWork      writeWork
+	receipt        MutationReceipt
+	resultCode     Code
+	ready          bool
+	resultReleased bool
+}
+
+func startLinuxWriteOperation(c Client, binary string, a NativeActor, b operationBinding, pin *pinnedReadOnlyRoot, w writeWork, input net.Conn) (operationProcess, error) {
+	if w.validate() != "" || pin == nil || pin.path != w.RootPath {
+		return nil, ErrDenied
+	}
+	w.Segments = append([]string{}, w.Segments...)
+	return startLinuxOperationWork(c, binary, a, b, input, pin, nil, &w)
+}
+func (p *linuxWriteOperation) idle() (bool, error) {
+	idle, e := p.linuxOperation.idle()
+	if p.result != nil && p.result.Mutation != nil {
+		p.receipt = *p.result.Mutation
+		p.resultCode = p.result.Code
+		p.ready = true
+		p.result = nil
+	}
+	return idle, e
+}
+func (p *linuxWriteOperation) mutationResult() (MutationReceipt, Code, bool) {
+	idle, e := p.idle()
+	if e != nil {
+		return p.receipt, ErrCleanupRequired, false
+	}
+	return p.receipt, p.resultCode, p.ready && idle
+}
+func (p *linuxWriteOperation) chunk(n uint32) error { return p.chunkWithActor(n, NativeActor{}) }
+func (p *linuxWriteOperation) chunkWithActor(n uint32, a NativeActor) error {
+	if !a.valid || !nativeFresh(a.account.CheckedAt, time.Now()) {
+		return ErrStale
+	}
+	return p.beginWrite(a, n, false)
+}
+func (p *linuxWriteOperation) commitWithActor(a NativeActor) error { return p.beginWrite(a, 0, true) }
+func (p *linuxWriteOperation) beginWrite(a NativeActor, n uint32, commit bool) error {
+	idle, e := p.idle()
+	if e != nil {
+		return e
+	}
+	if !idle || p.closed || !p.ready || p.resultCode != "" || p.finishSent || !a.valid || !nativeFresh(a.account.CheckedAt, time.Now()) || !commit && (n == 0 || n > MaxChunkBytes) {
+		return errTrust
+	}
+	p.proofDeadline = a.account.CheckedAt.Add(NativeProofFreshness)
+	p.sequence++
+	lease := operationLease{Token: p.token, Sequence: p.sequence, Bytes: n, SubjectRef: a.Principal().SubjectRef, SessionRef: a.SessionRef(), ProofDeadline: p.proofDeadline.UnixNano(), Commit: commit}
+	info, e := openOperationFDInfo(p.process.Pid)
+	if e != nil {
+		return e
+	}
+	done := make(chan operationRelayOutcome, 1)
+	p.pending = done
+	p.ready = false
+	control, data, input := p.control, p.data, p.output
+	boot, w := p.bootstrap, p.writeWork
+	sequence, mounts, deadline := p.sequence, p.mountSequence, p.proofDeadline
+	previous := p.receipt
+	results := make(chan readOnlyPacketOutcome, 1)
+	p.resultPending = results
+	// One outstanding lease. Read only the admitted bytes from the fixed binary
+	// input, then hand them to the actor. No bytes or file descriptors enter JSON.
+	go func() {
+		var e error
+		if !commit {
+			e = input.SetReadDeadline(deadline)
+			buffer := make([]byte, n)
+			if e == nil {
+				_, e = io.ReadFull(input, buffer)
+			}
+			if e == nil {
+				e = writeOperationPacket(control, lease)
+			}
+			if e == nil {
+				var written int
+				written, e = data.Write(buffer)
+				if e == nil && written != len(buffer) {
+					e = io.ErrShortWrite
+				}
+			}
+		} else {
+			e = writeOperationPacket(control, lease)
+		}
+		outcome := readOnlyPacketOutcome{}
+		if e == nil {
+			outcome = receiveWriteProof(control, info, boot, w, p.process.Pid, mounts, sequence, time.Until(deadline))
+			e = outcome.err
+			if e == nil {
+				m := outcome.result.Mutation
+				upper := previous.BytesWritten + uint64(n)
+				if commit {
+					upper = previous.BytesWritten
+				}
+				if m.BytesWritten < previous.BytesWritten || m.BytesWritten > upper || outcome.result.Code == "" && m.BytesWritten != upper || !commit && (m.Published || m.Committed) {
+					e = errTrust
+				}
+			}
+		}
+		if closeErr := info.Close(); e == nil {
+			e = closeErr
+		}
+		outcome.err = e
+		results <- outcome
+		done <- operationRelayOutcome{err: e, mountSequence: outcome.mountSequence}
+	}()
+	if commit {
+		p.finishSent = true
+	}
+	return nil
+}
+func receiveWriteProof(control *net.UnixConn, info *os.File, boot operationBootstrap, w writeWork, pid int, mounts, sequence uint64, timeout time.Duration) readOnlyPacketOutcome {
+	deadline := time.Now().Add(timeout)
+	for {
+		var packet readOnlyPacket
+		cred, e := readOperationPacketBound(control, &packet, MaxControlBytes, time.Until(deadline))
+		if e != nil {
+			return readOnlyPacketOutcome{err: e}
+		}
+		if cred == nil || int(cred.Pid) != pid || cred.Uid != boot.UID || cred.Gid != boot.GID || packet.Binding != boot.Binding || packet.Token != boot.Token {
+			return readOnlyPacketOutcome{err: errTrust}
+		}
+		if packet.Result != nil {
+			r := packet.Result
+			m := r.Mutation
+			if packet.MountFD != nil || packet.MountSequence != 0 || packet.ChunkSequence != sequence || m == nil || m.EffectsUnknown || m.BytesWritten > w.MaxBytes || m.Committed && !m.Published || m.Published && !m.Created || r.Bytes != 0 || r.Entry != nil || r.List != nil || r.Code != "" && !r.Code.Valid() {
+				return readOnlyPacketOutcome{err: errTrust}
+			}
+			return readOnlyPacketOutcome{result: r, mountSequence: mounts}
+		}
+		if packet.MountFD == nil || packet.ChunkSequence != 0 || packet.MountSequence != mounts+1 || mounts >= maxReadOnlyMountQueries {
+			return readOnlyPacketOutcome{err: errTrust}
+		}
+		mounts++
+		id, c := operationFDInfoMount(info, *packet.MountFD)
+		if e := writeOperationPacket(control, readOnlyMountReply{Token: boot.Token, Sequence: mounts, Mount: id, Code: c}); e != nil {
+			return readOnlyPacketOutcome{err: e}
+		}
+	}
+}
+func operationWriteChild(ctx context.Context, control *net.UnixConn, boot operationBootstrap) error {
+	w := *boot.Write
+	witness := os.NewFile(6, "write-root-witness")
+	if witness == nil {
+		return errTrust
+	}
+	defer witness.Close()
+	input := os.NewFile(5, "write-input")
+	if input == nil {
+		return errTrust
+	}
+	defer input.Close()
+	operationMountIDFallback = operationMountIDProxy(control, boot)
+	pin := &pinnedReadOnlyRoot{path: w.RootPath, file: witness}
+	x, c := openActorWriteTransfer(ctx, pin, w, operationReadOnlyACL)
+	receipt := MutationReceipt{}
+	if x != nil {
+		defer x.Close()
+		receipt = x.Receipt()
+	}
+	send := func(sequence uint64, r MutationReceipt, c Code) error {
+		return writeOperationPacketBound(control, readOnlyPacket{Binding: boot.Binding, Token: boot.Token, ChunkSequence: sequence, Result: &readOnlyResult{Code: c, Mutation: &r}}, MaxControlBytes)
+	}
+	if e := send(0, receipt, c); e != nil {
+		return e
+	}
+	if c != "" {
+		return awaitReadOnlyFinish(control, boot.Token)
+	}
+	var sequence, total uint64
+	for {
+		var lease operationLease
+		timeout := BoundedTimeout
+		if w.Staged {
+			timeout = StreamIdleTimeout
+		}
+		if deadline, ok := ctx.Deadline(); ok && time.Until(deadline) < timeout {
+			timeout = time.Until(deadline)
+		}
+		if _, e := readOperationPacketBound(control, &lease, MaxHealthBytes, timeout); e != nil {
+			return e
+		}
+		if lease.Token != boot.Token || lease.Sequence != sequence+1 || lease.SubjectRef != boot.SubjectRef || lease.SessionRef != boot.SessionRef || lease.ProofDeadline == 0 {
+			return errTrust
+		}
+		proofDeadline := time.Unix(0, lease.ProofDeadline)
+		if !time.Now().Before(proofDeadline) || time.Until(proofDeadline) > NativeProofFreshness {
+			return ErrStale
+		}
+		proofCtx, cancel := context.WithDeadline(ctx, proofDeadline)
+		sequence++
+		var r MutationReceipt
+		if lease.Commit {
+			if lease.Bytes != 0 {
+				cancel()
+				return errTrust
+			}
+			r, c = x.Commit(proofCtx)
+		} else {
+			if lease.Bytes == 0 || lease.Bytes > MaxChunkBytes || total+uint64(lease.Bytes) > w.MaxBytes {
+				cancel()
+				return errTrust
+			}
+			b := make([]byte, lease.Bytes)
+			input.SetReadDeadline(proofDeadline)
+			if _, e := io.ReadFull(input, b); e != nil {
+				cancel()
+				return e
+			}
+			total += uint64(lease.Bytes)
+			r, c = x.WriteChunk(proofCtx, b)
+		}
+		cancel()
+		if e := send(sequence, r, c); e != nil {
+			return e
+		}
+		// Retain lifetime/FDs until parent acknowledges or drains; receipt available
+		// even for partial effects. No named file is automatically cleaned up.
+		if lease.Commit || c != "" {
+			return awaitReadOnlyFinish(control, boot.Token)
+		}
+	}
+}
+
+func (p *linuxWriteOperation) releaseWriteResult() error {
+	if p.resultReleased {
+		return nil
+	}
+	p.resultReleased = true
+	return writeOperationPacket(p.control, operationReadOnlyFinish{Token: p.token})
+}

package/dist/templates/native-go/backend/internal/helper/write_test.go

@@ -0,0 +1,53 @@
+package helper
+
+import "testing"
+
+func TestWriteGatesDefaultDenyAndPublishIsIndependent(t *testing.T) {
+	for _, tc := range []struct {
+		gates   writeGates
+		action  Action
+		allowed bool
+	}{
+		{writeGates{}, ActionCreate, false}, {writeGates{}, ActionWriteStream, false},
+		{writeGates{Create: true}, ActionCreate, true}, {writeGates{Create: true}, ActionWriteStream, false},
+		{writeGates{Stream: true}, ActionWriteStream, false}, {writeGates{Create: true, Stream: true}, ActionWriteStream, false},
+		{writeGates{Create: true, Stream: true, Publish: true}, ActionWriteStream, true},
+		{writeGates{Publish: true}, ActionPublish, false}, {writeGates{Create: true, Publish: true}, ActionPublish, true},
+	} {
+		if tc.gates.allows(tc.action) != tc.allowed {
+			t.Fatal(tc)
+		}
+	}
+}
+func TestWriteWorkRejectsPathsLimitsAndUngatedStage(t *testing.T) {
+	valid := writeWork{RootPath: "/trusted/root", Action: ActionCreate, Segments: []string{"file"}, MaxBytes: MaxBoundedBytes}
+	if c := valid.validate(); c != "" {
+		t.Fatal(c)
+	}
+	for _, kind := range []string{"root", "escape", "zero", "limit", "action", "stage"} {
+		w := valid
+		switch kind {
+		case "root":
+			w.RootPath = "/"
+		case "escape":
+			w.Segments = []string{"..", "file"}
+		case "zero":
+			w.MaxBytes = 0
+		case "limit":
+			w.MaxBytes++
+		case "action":
+			w.Action = ActionRead
+		case "stage":
+			w.Staged = true
+		}
+		if c := w.validate(); c == "" {
+			t.Fatal("accepted", kind)
+		}
+	}
+}
+
+func TestWriteProofPacketDoesNotBecomeReadMetadata(t *testing.T) {
+	if (readOnlyResult{Mutation: &MutationReceipt{Created: true}}).validFor(readOnlyWork{Action: ActionRead, MaxBytes: 10}) {
+		t.Fatal("write receipt accepted as read metadata")
+	}
+}

package/dist/templates/native-go/ui/app.js

@@ -7,7 +7,14 @@
 //                               language ({name} placeholders, key.one/.other
 //                               plurals with { count }), English as fallback
 //   ctx.locale               -> "en", "zh-TW", … (use it for Intl formatting)
-//   ctx.reopen(fn)           -> fn runs each time DSM re-shows the window
+//   ctx.reopen(fn)           -> idempotent unsubscribe; fn runs on re-show
+//   ctx.host.platform()     -> read-only host/launch mode/language/version snapshot
+//   ctx.host.setTitle(text) -> encoded DSM title or standalone document.title;
+//                              inspect the returned status, not host authority
+//   ctx.host.subscribe(event, fn) -> status + dispose for window-resize;
+//                                   host-theme/language-change unsupported
+//   ctx.host.openFileManager(path) / revealFile(path) -> File Station virtual path
+//       request only; preview/details/settings return unsupported, never a grant
 // Replace everything below with your own UI (plain JS, or a bundle you build
 // with Vite/Vue into this folder -- see README.md).
 (function () {

package/dist/templates/native-go-better-auth/node/build.mjs

@@ -1,2 +1,4 @@
 import {build} from 'esbuild';
+import {writeThirdPartyNotices} from './third-party-notices.mjs';
 await build({entryPoints:['app.mjs'],bundle:true,platform:'node',format:'esm',target:'node22',outfile:'dist/app.mjs',banner:{js:"import {createRequire} from 'node:module'; const require = createRequire(import.meta.url);"}});
+writeThirdPartyNotices(process.cwd(), 'dist/LICENSES');

package/dist/templates/native-go-vue/README.md

@@ -19,6 +19,15 @@ The pinned `@synopackageland/ui@0.4.0` dependency is public on
 or credentials are required. Dependencies are installed and UI bundled on the
 build machine; the NAS never downloads npm packages. Commit your lockfiles.
 
+Vitest is pinned to **4.1.11** to fix CVE-2026-47429 and CVE-2026-84373.
+It and `@vitest/mocker` are development-only tools, excluded from the shipped
+browser bundle and SPK. Run `npm audit` separately to check the full lockfile;
+`npm audit --omit=dev` checks only production dependencies. These checks are
+snapshots of the advisory database, not a guarantee against future advisories.
+Keep the `--ignore-scripts` install above: npm install-script policy warnings
+are separate from vulnerability findings and do not require approving scripts
+for this template's test/build workflow.
+
 ## Optional integration (experimental)
 
 **Experimental integration — DSM 7.4 known limitation:** DSM ignores a
@@ -35,7 +44,7 @@ integration uses Go **1.25+** for fd-rooted atomic storage updates.
 
 Open the app as a DSM administrator. **Approve and activate** uses the existing
 DSM PasswordConfirm and exact-task readback, then `helper_enable`. Recover,
-Teardown and Disable call the other fixed public operations. Status always
+Teardown, Disable and Repair cleanup call the other fixed public operations. Status always
 comes from `integration.status`; scheduler approval is not helper readiness.
 Package running is `unknown`, scheduler `not-probed`: this backend has no fresh
 Package Center/scheduler probe. Use Package Center separately to read that state.
@@ -55,6 +64,53 @@ unsafe file metadata, serialize CGI readers/writers, and limit UTF-8 input to
 4096 bytes. Failed writes must be inspected/retried; no multi-file transaction,
 version history or general filesystem permission is implied.
 
+## NAS picker and grants (S4 mock preview)
+
+The Vue template includes `NasPathPicker` and `NasGrantSettings`, built from UI
+0.4.0's Dialog, TreeView, DataGrid, Button and SettingsSection. The existing
+browser `FilePicker` still represents local `File[]`; NAS selections return
+opaque directory grant handles. The new UI has catalogs for en, zh-TW, zh-CN,
+ja, ko, de, fr, es and it, selected from `ctx.locale` with English fallback.
+
+There is **no default NAS provider** and no new CGI/helper route. The existing
+DSM loader's two-argument mount remains unchanged and hides the NAS section.
+A development host can explicitly inject an in-memory fixture:
+
+```ts
+import {mount} from './src/main'
+import {createMockNasService} from './src/nas/mock-provider'
+
+const fixtures = createMockNasService({appName: 'My package', drained: false})
+const app = mount(root, ctx, {nasProvider: fixtures.connect('normal1')})
+// Another window can use fixtures.connect('normal2'); private grants stay separate.
+// Call app.unmount() when its window closes or its native subject changes.
+```
+
+Only `normal1`, `normal2` and `admin` are synthetic fixture subjects. The service
+uses S0 protocol-2 display projections and S1 discovery-anchor shape, not native
+identity proofs or filesystem authority. Candidate contexts expire in 60 seconds;
+one-use review intents expire in 30 seconds. Picker cancellation invalidates that
+context and creates no grant. Read-only actions are fixed; shared consent and
+shared revoke require the fixture's current administrator role. Fixture references
+and digest-shaped summary tokens are random; these are **not** S3 authenticated
+digests, durable storage, DSM ACL validation, or transferable grants.
+
+Grant state is separate from helper readiness. Revocation shows R (new access
+refused) separately from Q (transfers drained), including pending cleanup from a
+provider snapshot. It does not undo sent/written data. All fixture state disappears
+when this service instance is discarded. Neither mock success nor abort/timeout
+proves a NAS operation stopped. Each UI request is bounded to five seconds;
+close/unmount aborts pending work and ignores late results. A package/account
+change reported by app status discards the injected UI until the host remounts
+with a new per-session provider. Real adapters must validate the current session, local UID/username, enabled
+account, complete groups and App privilege on every call. Session switches
+require a new provider; relaxed mode accepts same-UID/same-name recreation.
+
+The mock is imported only by tests/development hosts and is not activated or
+bundled by the default entry point. Later S3/S5/S8 work must supply production
+adapters, durable/fence/ACL proofs and capability integration before connecting
+NAS data. Go-only and the existing protocol-1 manifest remain unchanged.
+
 ## Optional Better Auth
 
 Generate with `--ui vue --integration better-auth`. This is the only option that
@@ -108,3 +164,61 @@ reused before reaping. Startup still requires a live handshake within two second
 Lost supervisors preserve failed/cleanup-required; the controller never signals a
 recorded PID. Rebuild after M1d and approve the new payload digest before use.
 Uninstall retains disabled gate/cache/history by policy.
+
+
+## Repair after supervisor loss (R2)
+
+An administrator can choose **Repair cleanup** through the existing DSM
+PasswordConfirm and exact `helper_repair` task. Every Repair run asks for fresh
+password confirmation and rechecks the task afterward; cancellation runs nothing. A protected epoch lifetime lock,
+held by both the supervisor and its child until kernel exit, must be obtainable
+before cleanup. Repair clears only verified helper runtime residue, commits a
+private completion proof and preserves the approval/disabled gate. It never
+signals a recorded PID or restarts integration; use Recover or Approve and
+activate separately afterward. Missing, replaced or busy witnesses and foreign
+or live runtime paths refuse cleanup. Repeating Repair safely retries an
+interrupted cleanup transaction.
+
+Pre-R2 builds, including M1d/0001 Alpha and pre-R2 M1g, did not create this
+witness. Upgrading cannot supply historical proof: retain their residue and use
+the separately authorized reboot/Disable flow before upgrading. See
+`docs/m1a-helper-lifecycle-contract.md` in the SDK repository. R2 has local and
+isolated Linux systemd VM evidence; DSM 4.4 acceptance is still unknown.
+
+
+## M2 S1R build policy and unavailable delivery
+
+The S8 source candidate also accepts `--integration-protocol 2` with
+`--integration go` or `better-auth`. The default stays protocol 1. The manifest,
+compiled helper/CGI inventory, payload/worker digests, inspector and lifecycle
+approval pin the same protocol. A change requires exact new approval, never
+protocol 1 data fallback.
+
+Use `--data-access relaxed` with explicit protocol 2 to emit
+`integration.dataAccess: relaxed`. Omission keeps unavailable behavior; explicit
+`unavailable` is also accepted for protocol 2. The setting is bound into helper/CGI
+inventory, digests and root approval. Rebuild and obtain new approval to change it.
+It does not install missing adapters, enable write gates or certify NAS access.
+
+Relaxed identity records UID and username. Recreated accounts with the same pair
+may retain grants; changing either invalidates all grants for that identity and
+requires new authorization. Disabled accounts and revoked App access are denied.
+File operations use permanent dropped credentials and remain limited by NAS
+permissions and grant scope. See `docs/m2-s1r-relaxed-identity.md` in the SDK repo.
+
+NAS folder grants and file operations are not available for ordinary users or
+administrators. Production DSM identity, permission and scope adapters are not yet certified.
+Managed account pilot B is superseded by the relaxed UID/username contract. Enabling or
+recovering integration, or signing in again, does not unlock NAS access.
+Production shows this state in nine languages and supplies no picker/consent/
+file CTA. Only dev/test builds accept an injected mock provider with a preview
+banner; production ignores provider injection. No public data adapter is installed. Caller/admin/path fields never supply
+trusted session, UID, groups or App permission.
+
+Unknown NAS methods return `unknown_method`; the valid nil binary read route
+returns `unsupported`. Missing native proof is `unavailable`, wrong peer is
+`denied`, and unknown/stale/replay controls retain their own safe codes.
+Anonymous/expired DSM sessions return `session_required`; authentication failure
+returns `auth_unavailable`. Relogin restores only the ordinary app session.
+Positive NAS functionality, ACL and final DSM SPK acceptance remain blocked /
+unknown; local refusal and QEMU fixtures do not certify them.

package/dist/templates/native-go-vue/frontend/DESIGN.md

@@ -51,7 +51,7 @@ The application adds no shadows or elevation system. Surface, overlay and dialog
 ## Components
 
 - **AppRoot and lifecycle:** `mount(root, ctx)` creates a fresh Vue instance per DSM window. Reopen refreshes its status. Unmount marks the instance disposed and clears its app cookie, note text and opaque note ID; pending responses must not repopulate a disposed instance. Do not share user/session state between mounts.
-- **SettingsSection and status:** integration is always visible; sample data appears only in `ready`. Keep the six existing labels and descriptions from `context.ts`: `not-enabled` → Not enabled; `ready` → Ready; `needs-approval` → Approval required; `incompatible` → Incompatible; `stopped` → Stopped; `failed` → Failed. Show cleanup-required guidance and the returned package/scheduler values, including `unknown` or `not-probed`.
+- **SettingsSection and status:** integration is always visible; sample data appears only in `ready`. Keep the existing labels and descriptions from `context.ts`: `not-enabled` → Not enabled; `ready` → Ready; `needs-approval` → Approval required; `incompatible` → Incompatible; `stopped` → Stopped; `failed` → Failed; `pending` → Temporarily revalidating (localized safe copy). Pending hides sample authority and does not request administrator recovery. Show cleanup-required guidance and the returned package/scheduler values, including `unknown` or `not-probed`.
 - **Permissions and Button:** root controls appear only for an administrator with `ctx.root` and configured integration. Other accounts receive administrator guidance when integration is not ready. Activation/recovery/teardown/disable follow authorization before execution; cancelled approval reports that no operation ran.
 - **Loading, empty and mutation states:** Refresh and mutations disable competing controls; the main region exposes `aria-busy` and textual status. Failed status loading offers Refresh. A ready integration with no note ID shows the “No sample data” Callout. A labeled Textarea and Save button appear when a note exists. Completion notices use `role=status`; error copy uses `role=alert` and identifies a recovery action. Optional app identity appears only when its route reports `better-auth`.
 - **Dialog:** Disable opens the library confirmation dialog, explains refusal of new requests and retention of existing data/output, and presents Cancel plus danger Confirm disable. No application modal replacement is provided.