@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -0,0 +1,61 @@
+DSM integration helper build dependencies
+
+github.com/godbus/dbus/v5 v5.2.3-0.20260924123156-0ea052abeb82 (BSD-2-Clause)
+Pinned upstream commit: 0ea052abeb820894f944095b3c2dc125cef0df85
+Fix panic in DecodeMessageWithFDs on read error (not yet in a tagged release).
+
+Copyright (c) 2013, Georg Reinke (<guelfey at gmail dot com>), Google
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright notice,
+this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+golang.org/x/sys v0.27.0 (BSD-3-Clause)
+
+Copyright 2009 The Go Authors.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google LLC nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/templates/native-go/backend/cmd/app/main.go

@@ -1,5 +1,9 @@
+//go:build !synopkgland_sdk_workers
+
 // Command app is the package backend. DSM runs it as a CGI (ui/cgi/api.cgi in
 // the package) under the package account, once per request.
+//
+//line dsmapp/cmd/app/main.go:1
 package main
 
 import (
@@ -12,6 +16,7 @@ import (
 	"dsmapp/internal/api"
 	"dsmapp/internal/app"
 	"dsmapp/internal/dsm"
+	"dsmapp/internal/filestation"
 	"dsmapp/internal/helper"
 )
 
@@ -20,6 +25,10 @@ var (
 	packageID       = "dev"
 	version         = "0.0.0"
 	helperInventory = ""
+	// "package" when the project has an integration but no privileged helper.
+	integrationMode = ""
+	// "session" when the project opted into the interactive File Station adapter.
+	fileStation = ""
 )
 
 func main() {
@@ -33,12 +42,20 @@ func main() {
 		PackageID: packageID,
 		Version:   version,
 		DataDir:   "/var/packages/" + packageID + "/var",
+
+		PackageIntegration: integrationMode == "package",
 	}
 	if helperInventory != "" {
 		if json.Unmarshal([]byte(helperInventory), &cfg.HelperInventory) != nil || cfg.HelperInventory.Package != packageID || cfg.HelperInventory.Version != version {
 			cfg.HelperInventory = helper.Inventory{Package: packageID}
 		}
 	}
+	if err := app.Migrate(cfg); err != nil {
+		log.Fatalf("schema migration failed: %v", err)
+	}
+	if app.SessionFilesEnabled(cfg.HelperInventory, fileStation) {
+		cfg.SessionFiles = filestation.Local(cfg.DataDir)
+	}
 	srv, err := api.NewServer(dsm.NewAuthenticator(), app.Routes(cfg)...)
 	if err != nil {
 		log.Fatal(err)

package/templates/native-go/backend/cmd/app/sdk_main.go

@@ -0,0 +1,60 @@
+//go:build synopkgland_sdk_workers
+
+// Command app is the package backend. DSM runs it as a CGI (ui/cgi/api.cgi in
+// the package) under the package account, once per request.
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http/cgi"
+	"os"
+
+	"dsmapp/internal/api"
+	"dsmapp/internal/app"
+	"dsmapp/internal/dsm"
+	"dsmapp/internal/filestation"
+	"dsmapp/internal/helper"
+)
+
+// Set by `synopkgland build-spk` through -ldflags -X; never read from a request.
+var (
+	packageID       = "dev"
+	version         = "0.0.0"
+	helperInventory = ""
+	// "session" when the project opted into the interactive File Station adapter.
+	fileStation = ""
+)
+
+func main() {
+	log.SetFlags(0)
+	log.SetPrefix(packageID + ": ")
+	if os.Getenv("GATEWAY_INTERFACE") == "" {
+		fmt.Fprintf(os.Stderr, "%s %s: this program runs as the package's DSM CGI; open the app from the DSM main menu.\n", packageID, version)
+		os.Exit(2)
+	}
+	cfg := app.Config{
+		PackageID: packageID,
+		Version:   version,
+		DataDir:   "/var/packages/" + packageID + "/var",
+	}
+	if helperInventory != "" {
+		if json.Unmarshal([]byte(helperInventory), &cfg.HelperInventory) != nil || cfg.HelperInventory.Package != packageID || cfg.HelperInventory.Version != version {
+			cfg.HelperInventory = helper.Inventory{Package: packageID}
+		}
+	}
+	if err := app.Migrate(cfg); err != nil {
+		log.Fatalf("schema migration failed: %v", err)
+	}
+	if app.SessionFilesEnabled(cfg.HelperInventory, fileStation) {
+		cfg.SessionFiles = filestation.Local(cfg.DataDir)
+	}
+	srv, err := api.NewServer(dsm.NewAuthenticator(), app.Routes(cfg)...)
+	if err != nil {
+		log.Fatal(err)
+	}
+	if err := cgi.Serve(app.SDKHandler(srv)); err != nil {
+		log.Fatal(err)
+	}
+}

package/templates/native-go/backend/cmd/background-worker/main.go

@@ -0,0 +1,38 @@
+// Command background-worker is the package's fixed background worker. DSM runs
+// it as the package's systemd user unit under the package account; it never
+// runs as root and takes no input except the jobs in its private spool.
+package main
+
+import (
+	"context"
+	"log"
+	"os"
+	"os/signal"
+	"os/user"
+	"strconv"
+	"syscall"
+
+	"dsmapp/internal/background"
+)
+
+// Set by `synopkgland build-spk` through -ldflags -X.
+var packageID = "dev"
+
+func main() {
+	log.SetFlags(0)
+	log.SetPrefix(packageID + " background: ")
+	if err := background.RefuseRoot(os.Geteuid()); err != nil {
+		log.Fatal(err)
+	}
+	name := ""
+	if u, err := user.Current(); err == nil {
+		name = u.Username
+	}
+	info := background.WorkerInfo{PID: os.Getpid(), UID: os.Getuid(), Username: name}
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
+	defer stop()
+	log.Printf("started as uid %s", strconv.Itoa(info.UID))
+	if err := background.NewRunner("/var/packages/"+packageID+"/var/background", info).Run(ctx); err != nil {
+		log.Fatal(err)
+	}
+}

package/templates/native-go/backend/cmd/dsm-readonly-probe/main_linux.go

@@ -0,0 +1,46 @@
+// A standalone evidence-only static probe. No helper activation or mutation.
+package main
+
+import (
+	"context"
+	"dsmapp/internal/dsmprobe"
+	"encoding/json"
+	"golang.org/x/sys/unix"
+	"io"
+	"os"
+	"runtime"
+	"time"
+)
+
+func main() {
+	if len(os.Args) != 2 || os.Args[1] != "--wire-v1" {
+		os.Exit(2)
+	}
+	// Watchdog owns this bounded observation; no children or services are created.
+	go func() { time.Sleep(8 * time.Second); os.Exit(124) }()
+	runtime.LockOSThread()
+	if unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != nil || unix.Prctl(unix.PR_SET_DUMPABLE, 0, 0, 0, 0) != nil {
+		os.Exit(3)
+	}
+	data, e := io.ReadAll(io.LimitReader(os.Stdin, dsmprobe.MaxRequestBytes+1))
+	if e != nil {
+		os.Exit(2)
+	}
+	request, e := dsmprobe.DecodeRequest(data)
+	if e != nil {
+		os.Exit(2)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 7*time.Second)
+	defer cancel()
+	out, e := dsmprobe.Collect(ctx, request)
+	if e != nil {
+		out.Status = "unsupported"
+	}
+	data, e = json.Marshal(out)
+	if e != nil || len(data) > dsmprobe.MaxResponseBytes {
+		os.Exit(3)
+	}
+	if _, e = os.Stdout.Write(append(data, '\n')); e != nil {
+		os.Exit(3)
+	}
+}

package/templates/native-go/backend/cmd/helper/main.go

@@ -16,11 +16,20 @@ func main() {
 	if len(os.Args) != 2 || json.Unmarshal([]byte(helperInventory), &i) != nil {
 		os.Exit(2)
 	}
-	if os.Args[1] == "check-stopped" || os.Args[1] == "diagnose" {
+	if os.Args[1] == "check-stopped" || os.Args[1] == "diagnose" || os.Args[1] == "diagnose-startup" {
 		c, err := helper.LocalClient(i)
 		if err != nil {
 			os.Exit(1)
 		}
+		if os.Args[1] == "diagnose-startup" {
+			diagnostic, err := c.StartupDiagnostic()
+			if err != nil {
+				fmt.Fprintln(os.Stderr, "startup diagnostic unavailable")
+				os.Exit(1)
+			}
+			json.NewEncoder(os.Stdout).Encode(diagnostic)
+			return
+		}
 		if os.Args[1] == "diagnose" {
 			json.NewEncoder(os.Stdout).Encode(c.Status(context.Background()))
 			return

package/templates/native-go/backend/cmd/helper/sdk_registry.go

@@ -0,0 +1,19 @@
+//go:build synopkgland_sdk_workers
+
+package main
+
+import (
+	"dsmapp/internal/helper"
+	"encoding/json"
+	"os"
+)
+
+// Linker-bound source-validated registry, never package-writable JSON.
+var sdkWorkerRegistry string
+
+func init() {
+	var inventory helper.Inventory
+	if json.Unmarshal([]byte(helperInventory), &inventory) != nil || helper.InstallSDKRegistry(inventory, sdkWorkerRegistry) != "" {
+		os.Exit(2)
+	}
+}

package/templates/native-go/backend/go.mod

@@ -1,3 +1,9 @@
 module dsmapp
 
-go 1.24
+go 1.25.0
+
+toolchain go1.26.8
+
+require github.com/godbus/dbus/v5 v5.2.3-0.20260924123156-0ea052abeb82
+
+require golang.org/x/sys v0.44.0

package/templates/native-go/backend/go.sum

@@ -0,0 +1,4 @@
+github.com/godbus/dbus/v5 v5.2.3-0.20260924123156-0ea052abeb82 h1:QN/vQc8LI8KFWH6uZZ4R4jermkdwzvKzGy0Taimhbm0=
+github.com/godbus/dbus/v5 v5.2.3-0.20260924123156-0ea052abeb82/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
+golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
+golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-go/backend/internal/api/binary.go

@@ -0,0 +1,154 @@
+package api
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"regexp"
+	"strconv"
+	"sync"
+	"time"
+)
+
+const MaxBinaryReadBytes = 1 << 20
+const BinaryReadTimeout = 10 * time.Second
+
+// Control IDs are not bearer authority. The trusted adapter must revalidate
+// the original caller/session, epoch, grant revision and every chunk ticket.
+// The fixed route accepts no path, offset, range, URL, filename or MIME type.
+type BinaryReadRequest struct {
+	OperationID string `json:"operationId"`
+	Epoch       string `json:"epoch"`
+	Token       string `json:"token"`
+}
+
+// Body must implement Close concurrently with Read and unblock it on Close.
+// Close releases/cancels the helper transfer; it is not itself a Q receipt.
+type BinaryRead struct {
+	Body        io.ReadCloser
+	Bytes       uint64
+	OperationID string
+}
+type BinaryReadHandler func(context.Context, Caller, *http.Request, json.RawMessage) (BinaryRead, error)
+
+func BoundedRead(h BinaryReadHandler) Route {
+	return Route{method: "nas.files.read.binary", policy: policyUser, binary: h}
+}
+
+var binaryReference = regexp.MustCompile(`^[a-f0-9]{64}$`)
+
+func serveBoundedRead(w http.ResponseWriter, r *http.Request, c Caller, params json.RawMessage, h BinaryReadHandler) {
+	if r.Context().Err() != nil {
+		writeError(w, &Error{"canceled", "read canceled"})
+		return
+	}
+	if r.Header.Get("Range") != "" {
+		writeError(w, BadRequest("ranges are unsupported"))
+		return
+	}
+	in, ok := decodeBinaryReadControl(params)
+	if !ok {
+		writeError(w, BadRequest("invalid binary read control"))
+		return
+	}
+	ctx, cancel := context.WithTimeout(r.Context(), BinaryReadTimeout)
+	defer cancel()
+	result, err := h(ctx, c, r, params)
+	if err != nil {
+		if result.Body != nil {
+			result.Body.Close()
+		}
+		writeError(w, asError(err))
+		return
+	}
+	if result.Body == nil {
+		writeError(w, internalError)
+		return
+	}
+	var once sync.Once
+	var closeErr error
+	closeBody := func() { once.Do(func() { closeErr = result.Body.Close() }) }
+	defer closeBody()
+	if result.Bytes > MaxBinaryReadBytes || result.OperationID != in.OperationID {
+		writeError(w, BadRequest("invalid bounded read result"))
+		return
+	}
+	stop := make(chan struct{})
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		select {
+		case <-ctx.Done():
+			closeBody()
+		case <-stop:
+		}
+	}()
+	// Materialize only the bounded response so short/error/overlong transfers
+	// cannot become successful binary responses. Helper relay still leases at
+	// most one 64KiB chunk. Long CGI streaming remains disabled pending DSM proof.
+	body, readErr := io.ReadAll(io.LimitReader(result.Body, int64(result.Bytes)+1))
+	closeBody()
+	close(stop)
+	<-done
+	if ctx.Err() != nil {
+		writeError(w, &Error{"canceled", "read expired or canceled"})
+		return
+	}
+	if readErr != nil || closeErr != nil || uint64(len(body)) != result.Bytes {
+		writeError(w, &Error{"read_failed", "binary read failed"})
+		return
+	}
+	headers := w.Header()
+	headers.Set("Content-Type", "application/octet-stream")
+	headers.Set("Content-Length", strconv.FormatUint(result.Bytes, 10))
+	headers.Set("Cache-Control", "no-store")
+	headers.Set("X-Content-Type-Options", "nosniff")
+	w.WriteHeader(http.StatusOK)
+	// Go CGI may buffer or block stdout. All helper resources have already been
+	// released; there is no long-stream readiness claim from this bounded write.
+	_, _ = w.Write(body)
+}
+
+// Fixed shape with duplicate-key rejection, so two parsers cannot bind a token
+// to different operations. Controls never grow the existing ctx.call envelope.
+func decodeBinaryReadControl(raw json.RawMessage) (BinaryReadRequest, bool) {
+	var in BinaryReadRequest
+	if len(raw) > 16*1024 {
+		return in, false
+	}
+	d := json.NewDecoder(bytes.NewReader(raw))
+	first, e := d.Token()
+	if e != nil || first != json.Delim('{') {
+		return in, false
+	}
+	seen := map[string]bool{}
+	for d.More() {
+		token, e := d.Token()
+		key, ok := token.(string)
+		if e != nil || !ok || seen[key] {
+			return in, false
+		}
+		seen[key] = true
+		var value string
+		if d.Decode(&value) != nil {
+			return in, false
+		}
+		switch key {
+		case "operationId":
+			in.OperationID = value
+		case "epoch":
+			in.Epoch = value
+		case "token":
+			in.Token = value
+		default:
+			return in, false
+		}
+	}
+	end, e := d.Token()
+	if e != nil || end != json.Delim('}') || d.Decode(new(any)) != io.EOF {
+		return in, false
+	}
+	return in, binaryReference.MatchString(in.OperationID) && binaryReference.MatchString(in.Epoch) && binaryReference.MatchString(in.Token)
+}

package/templates/native-go/backend/internal/api/binary_test.go

@@ -0,0 +1,165 @@
+package api
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/cgi"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+type binarySource struct {
+	io.Reader
+	closed bool
+}
+
+func (s *binarySource) Close() error { s.closed = true; return nil }
+func TestBoundedReadBinaryGuardAndBody(t *testing.T) {
+	for _, kind := range []string{"valid", "anonymous", "cross-origin", "oversize", "short", "nil", "cancel"} {
+		t.Run(kind, func(t *testing.T) {
+			auth := &fakeAuth{user: "normal1"}
+			if kind == "anonymous" {
+				auth.err = ErrNoSession
+			}
+			src := &binarySource{Reader: bytes.NewReader([]byte{0, 1, 255, 10})}
+			called := false
+			srv, e := NewServer(auth, BoundedRead(func(ctx context.Context, c Caller, r *http.Request, params json.RawMessage) (BinaryRead, error) {
+				called = true
+				if !c.Authenticated() || c.User() != "normal1" {
+					t.Fatal(c)
+				}
+				n := uint64(4)
+				if kind == "oversize" {
+					n = MaxBinaryReadBytes + 1
+				}
+				if kind == "short" {
+					n = 5
+				}
+				if kind == "nil" {
+					return BinaryRead{}, nil
+				}
+				return BinaryRead{Body: src, Bytes: n, OperationID: strings.Repeat("a", 64)}, nil
+			}))
+			if e != nil {
+				t.Fatal(e)
+			}
+			r := httptest.NewRequest("POST", "http://nas.local/cgi/api.cgi", strings.NewReader(`{"method":"nas.files.read.binary","params":{"operationId":"`+strings.Repeat("a", 64)+`","epoch":"`+strings.Repeat("b", 64)+`","token":"`+strings.Repeat("c", 64)+`"}}`))
+			r.Header.Set("Content-Type", "application/json")
+			if kind == "cross-origin" {
+				r.Header.Set("Origin", "http://evil.local")
+			}
+			if kind == "cancel" {
+				ctx, cancel := context.WithCancel(r.Context())
+				cancel()
+				r = r.WithContext(ctx)
+			}
+			w := httptest.NewRecorder()
+			srv.ServeHTTP(w, r)
+			if kind == "valid" {
+				if w.Header().Get("Content-Type") != "application/octet-stream" || !bytes.Equal(w.Body.Bytes(), []byte{0, 1, 255, 10}) || w.Header().Get("Content-Length") != "4" || !src.closed {
+					t.Fatal(w.Body.String(), w.Header())
+				}
+			} else {
+				if w.Header().Get("Content-Type") != "application/json" {
+					t.Fatal("invalid binary escaped")
+				}
+				if (kind == "anonymous" || kind == "cross-origin" || kind == "cancel") && called {
+					t.Fatal("handler called before guards")
+				}
+				if called && kind != "nil" && !src.closed {
+					t.Fatal("source not closed")
+				}
+			}
+		})
+	}
+}
+
+type blockedBinarySource struct {
+	done chan struct{}
+	once sync.Once
+}
+
+func (s *blockedBinarySource) Read([]byte) (int, error) { <-s.done; return 0, io.ErrClosedPipe }
+func (s *blockedBinarySource) Close() error             { s.once.Do(func() { close(s.done) }); return nil }
+func TestBoundedBinaryDisconnectCancelsSource(t *testing.T) {
+	src := &blockedBinarySource{done: make(chan struct{})}
+	started := make(chan struct{})
+	srv, e := NewServer(&fakeAuth{user: "normal1"}, BoundedRead(func(context.Context, Caller, *http.Request, json.RawMessage) (BinaryRead, error) {
+		close(started)
+		return BinaryRead{Body: src, Bytes: 1, OperationID: strings.Repeat("a", 64)}, nil
+	}))
+	if e != nil {
+		t.Fatal(e)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	r := httptest.NewRequest("POST", "http://nas.local/cgi/api.cgi", strings.NewReader(`{"method":"nas.files.read.binary","params":{"operationId":"`+strings.Repeat("a", 64)+`","epoch":"`+strings.Repeat("b", 64)+`","token":"`+strings.Repeat("c", 64)+`"}}`)).WithContext(ctx)
+	r.Header.Set("Content-Type", "application/json")
+	done := make(chan struct{})
+	go func() { defer close(done); srv.ServeHTTP(httptest.NewRecorder(), r) }()
+	<-started
+	cancel()
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("disconnect did not release bounded source")
+	}
+}
+func TestBoundedBinaryRejectsCallerPathsAndTransferSubstitution(t *testing.T) {
+	calls := 0
+	srv, e := NewServer(&fakeAuth{user: "normal1"}, BoundedRead(func(context.Context, Caller, *http.Request, json.RawMessage) (BinaryRead, error) {
+		calls++
+		return BinaryRead{}, nil
+	}))
+	if e != nil {
+		t.Fatal(e)
+	}
+	for _, params := range []string{`{}`, `{"operationId":"x"}`, `{"operationId":"` + strings.Repeat("a", 64) + `","epoch":"` + strings.Repeat("b", 64) + `","token":"` + strings.Repeat("c", 64) + `","path":"/secret"}`} {
+		_, env := post(t, srv, `{"method":"nas.files.read.binary","params":`+params+`}`)
+		if env.Success || env.Error == nil || env.Error.Code != "bad_request" {
+			t.Fatal(env)
+		}
+	}
+	if calls != 0 {
+		t.Fatal("invalid control reached adapter")
+	}
+}
+
+func TestBoundedBinaryRealCGIWire(t *testing.T) {
+	requestBody := `{"method":"nas.files.read.binary","params":{"operationId":"` + strings.Repeat("a", 64) + `","epoch":"` + strings.Repeat("b", 64) + `","token":"` + strings.Repeat("c", 64) + `"}}`
+	h := &cgi.Handler{Path: os.Args[0], Args: []string{"-test.run=TestBoundedBinaryCGIProcessFixture"}, Env: []string{"S6_CGI_FIXTURE=1"}}
+	r := httptest.NewRequest("POST", "http://nas.local/cgi/api.cgi", strings.NewReader(requestBody))
+	r.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+	if w.Code != http.StatusOK || w.Header().Get("Content-Type") != "application/octet-stream" || w.Header().Get("Content-Length") != "1048576" || !bytes.Equal(w.Body.Bytes(), bytes.Repeat([]byte{0, 255, 10, 13}, MaxBinaryReadBytes/4)) {
+		t.Fatal(w.Code, w.Header(), w.Body.Len())
+	}
+}
+func TestBoundedBinaryCGIProcessFixture(t *testing.T) {
+	if os.Getenv("S6_CGI_FIXTURE") != "1" {
+		t.Skip("spawned CGI-only process")
+	}
+	srv, e := NewServer(&fakeAuth{user: "normal1"}, BoundedRead(func(context.Context, Caller, *http.Request, json.RawMessage) (BinaryRead, error) {
+		return BinaryRead{Body: io.NopCloser(bytes.NewReader(bytes.Repeat([]byte{0, 255, 10, 13}, MaxBinaryReadBytes/4))), Bytes: MaxBinaryReadBytes, OperationID: strings.Repeat("a", 64)}, nil
+	}))
+	if e != nil {
+		os.Exit(1)
+	}
+	if cgi.Serve(srv) != nil {
+		os.Exit(1)
+	}
+	os.Exit(0)
+}
+func TestBinaryControlRejectsDuplicates(t *testing.T) {
+	raw := `{"operationId":"` + strings.Repeat("a", 64) + `","epoch":"` + strings.Repeat("b", 64) + `","token":"` + strings.Repeat("c", 64) + `","token":"` + strings.Repeat("d", 64) + `"}`
+	if _, ok := decodeBinaryReadControl(json.RawMessage(raw)); ok {
+		t.Fatal("duplicate transfer token")
+	}
+}