@synopackageland/cli 0.4.1 → 0.5.3

package/dist/standalone/host-file-navigation.js

@@ -0,0 +1,172 @@
+/** Shared virtual-path validation and File Station request shaping. */
+export const HOST_FILE_NAVIGATION_RUNTIME = `
+function requestHostFileNavigation(launch, path, isDirectory) {
+  if (typeof path !== "string" || path.length > 4096 || path.charAt(0) !== "/" ||
+    /[\\x00-\\x1f\\x7f\\\\]/.test(path)) return { status: "invalid-input" };
+  var parts = path.split("/");
+  if (/^volume[0-9]+$/i.test(parts[1]) || parts.slice(1).some(function (part) {
+    return !part || part === "." || part === "..";
+  })) return { status: "invalid-input" };
+  var result = launch("SYNO.SDS.App.FileStation3.Instance", isDirectory ? { opendir: path } : { openfile: path });
+  if (result.status !== "requested") return result;
+  return { status: "requested", action: isDirectory ? "locate-folder" : "highlight-file" };
+}
+`;
+// Engineering bounds, not DSM/File Station latency proof.
+export const REVEAL_RECOVERY_TIMEOUT_MS = 5000;
+export const REVEAL_RECOVERY_POLL_MS = 100;
+export const REVEAL_RECOVERY_QUIET_MS = 300;
+/** Best-effort recovery for File Station 1.4.x private structures. */
+export const HOST_FILE_REVEAL_RUNTIME = `
+var REVEAL_RECOVERY_TIMEOUT_MS = ${REVEAL_RECOVERY_TIMEOUT_MS};
+var REVEAL_RECOVERY_POLL_MS = ${REVEAL_RECOVERY_POLL_MS};
+var REVEAL_RECOVERY_QUIET_MS = ${REVEAL_RECOVERY_QUIET_MS};
+var hostFileRevealOwners = null, hostFileRevealSequence = 0;
+try { if (typeof WeakMap === "function") hostFileRevealOwners = new WeakMap(); } catch (error) {}
+function createHostFileRevealRecovery(path, canAct) {
+  var active = true, accepted = false, win = null, dom = null, tuple = null;
+  var poll = null, deadline = null, removers = [], reached = false, pending = 0;
+  var previous = null, quietSince = null, expires = 0, order = ++hostFileRevealSequence;
+  var parent = path.slice(0, path.lastIndexOf("/"));
+  function cancel() {
+    if (!active) return;
+    active = false;
+    try { if (poll !== null) clearTimeout(poll); } catch (error) {}
+    try { if (deadline !== null) clearTimeout(deadline); } catch (error) {}
+    poll = deadline = null;
+    removers.splice(0).forEach(function (remove) { try { remove(); } catch (error) {} });
+    try {
+      if (win && hostFileRevealOwners.get(win).order === order) {
+        // Preserve ordering for a late older callback, without retaining its closures.
+        hostFileRevealOwners.set(win, { order: order, cancel: null });
+      }
+    } catch (error) {}
+    win = dom = tuple = previous = null;
+  }
+  function requireMethods(target, names) {
+    if (!target || names.some(function (name) { return typeof target[name] !== "function"; })) throw new Error("unsupported receiver");
+  }
+  function guard(fn) {
+    return function () {
+      if (!active) return;
+      try { fn.apply(null, arguments); } catch (error) { cancel(); }
+    };
+  }
+  function listen(target, event, fn) {
+    requireMethods(target, ["on", "un"]);
+    var handler = guard(fn), remove = target.un;
+    removers.push(function () { remove.call(target, event, handler, target); });
+    target.on(event, handler, target);
+  }
+  function resetQuiet() { previous = null; quietSince = null; }
+  function inspect() {
+    requireMethods(win, ["getPanelInstance", "getEl", "on", "un"]);
+    if (win.isDestroyed || win.destroyed || !canAct()) { cancel(); return null; }
+    var element = win.getEl(), nextDom = element && element.dom;
+    if (!nextDom) { if (dom) cancel(); return null; }
+    requireMethods(nextDom, ["addEventListener", "removeEventListener"]);
+    if (dom && nextDom !== dom) { cancel(); return null; }
+    if (!dom) {
+      dom = nextDom;
+      ["pointerdown", "mousedown", "touchstart", "keydown", "wheel", "click", "input"].forEach(function (event) {
+        var remove = dom.removeEventListener, handler = guard(cancel), target = dom;
+        removers.push(function () { remove.call(target, event, handler, true); });
+        dom.addEventListener(event, handler, true);
+      });
+    }
+    var panel = win.getPanelInstance();
+    if (!panel) { if (tuple) cancel(); return null; }
+    requireMethods(panel, ["getCurrentDir", "on", "un"]);
+    var view = panel.activeView, store = panel.activeDS;
+    requireMethods(view, ["getStore", "getSelectionModel", "scrollToItem"]);
+    requireMethods(store, ["on", "un", "indexOfId", "getAt", "getCount"]);
+    var model = view.getSelectionModel();
+    requireMethods(model, ["on", "un", "getSelections", "selectRow"]);
+    if (view.getStore() !== store || panel.isDestroyed || store.isDestroyed || model.isDestroyed) { cancel(); return null; }
+    if (tuple && (tuple.panel !== panel || tuple.view !== view || tuple.store !== store || tuple.model !== model)) { cancel(); return null; }
+    if (!tuple) {
+      tuple = { panel: panel, view: view, store: store, model: model };
+      listen(panel, "destroy", cancel);
+      listen(panel, "onNodeClick", function (node) {
+        if (!node || !node.attributes || (reached && node.attributes.path !== parent)) cancel();
+      });
+      listen(store, "beforeload", function () {
+        pending++; resetQuiet(); inspect();
+      });
+      listen(store, "load", function () {
+        if (pending > 0) pending--;
+        resetQuiet(); check();
+      });
+      ["exception", "loadexception", "destroy"].forEach(function (event) { listen(store, event, cancel); });
+      listen(model, "selectionchange", function () { resetQuiet(); check(); });
+    }
+    var dir = panel.getCurrentDir(), params = store.baseParams;
+    // New File Station panels expose their APIs before the first directory is set.
+    // Keep the bound receiver guards and original deadline while startup finishes.
+    if (!reached && dir === undefined && (!params || params.folder_path === undefined)) return null;
+    if (!params || typeof params.folder_path !== "string") throw new Error("unsupported store path");
+    // Native reconfigure/selection events can precede the store's path assignment.
+    if (dir === parent && params.folder_path === parent) reached = true;
+    if (reached && (dir !== parent || params.folder_path !== parent)) { cancel(); return null; }
+    var selections = model.getSelections();
+    if (!Array.isArray(selections)) throw new Error("unsupported selection");
+    if (selections.some(function (record) { return !record || record.id !== path; })) { cancel(); return null; }
+    var index = store.indexOfId(path), count = store.getCount();
+    if (!Number.isInteger(index) || index < -1 || !Number.isInteger(count) || count < 0) throw new Error("unsupported store index");
+    var record = index >= 0 ? store.getAt(index) : null;
+    if (index >= 0 && (!record || record.id !== path || index >= count)) throw new Error("inconsistent store");
+    return { dir: dir, folder: params.folder_path, count: count, index: index, record: record, selected: selections.length > 0 };
+  }
+  function check() {
+    if (!active) return;
+    if (Date.now() >= expires || !canAct()) { cancel(); return; }
+    if (!win) return;
+    var state = inspect();
+    if (!active || !state) return;
+    if (pending || state.dir !== parent || state.folder !== parent || state.index < 0) { resetQuiet(); return; }
+    if (!previous || Object.keys(state).some(function (key) { return state[key] !== previous[key]; })) {
+      previous = state; quietSince = Date.now();
+    }
+    if (Date.now() - quietSince < REVEAL_RECOVERY_QUIET_MS) return;
+    var target = tuple, receiverWindow = win;
+    cancel(); // Release every observer before the one permitted selection mutation.
+    if (state.selected || !canAct()) return;
+    target.model.selectRow(state.index);
+    if (canAct() && !receiverWindow.isDestroyed && receiverWindow.getPanelInstance() === target.panel &&
+        target.panel.activeView === target.view && target.panel.activeDS === target.store &&
+        target.view.getSelectionModel() === target.model) target.view.scrollToItem(state.index);
+  }
+  function tick() {
+    poll = null;
+    try {
+      check();
+      if (active) poll = setTimeout(tick, REVEAL_RECOVERY_POLL_MS);
+    } catch (error) { cancel(); }
+  }
+  function receive(instance) {
+    if (!active || accepted) return;
+    accepted = true;
+    try {
+      if (Date.now() >= expires || !canAct()) { cancel(); return; }
+      win = instance && instance.window;
+      requireMethods(win, ["getPanelInstance", "getEl", "on", "un"]);
+      var owner = hostFileRevealOwners.get(win);
+      if (owner && owner.order > order) { cancel(); return; }
+      if (owner && owner.cancel) owner.cancel();
+      hostFileRevealOwners.set(win, { order: order, cancel: cancel });
+      ["beforeclose", "close", "beforedestroy", "destroy", "hide"].forEach(function (event) { listen(win, event, cancel); });
+      check();
+    } catch (error) { cancel(); }
+  }
+  try {
+    if (!parent || !hostFileRevealOwners || typeof setTimeout !== "function" || typeof clearTimeout !== "function" || typeof Date.now !== "function") {
+      cancel();
+    } else {
+      expires = Date.now() + REVEAL_RECOVERY_TIMEOUT_MS;
+      deadline = setTimeout(cancel, REVEAL_RECOVERY_TIMEOUT_MS);
+      poll = setTimeout(tick, REVEAL_RECOVERY_POLL_MS);
+    }
+  } catch (error) { cancel(); }
+  return { receive: receive, cancel: cancel };
+}
+`;

package/dist/standalone/inspect-helper.js

@@ -1,3 +1,4 @@
+import { bootstrapOps } from "./authorization.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import * as tar from "tar";
@@ -6,6 +7,7 @@ import { helperOps } from "./helper.js";
 import { sha256 } from "./helper-inventory.js";
 import { renderStandaloneScript } from "./lifecycle.js";
 import { rootTasks } from "./root-window.js";
+import { decodeSDKRegistry } from "./worker-registry.js";
 /** Artifact consistency only; bytes, approval and health never certify NAS access. */
 export async function inspectHelper(dir, info, findings, daemon = false) {
     const files = new Map();
@@ -17,7 +19,7 @@ export async function inspectHelper(dir, info, findings, daemon = false) {
             // Enumerate candidates to reject extras; only the INFO-derived exact path is read.
             if (/^ui\/window-[^/]*\.js$/.test(path))
                 windows.push(path);
-            if (entry.type !== "File" || !(path.startsWith("integration/workers/") || ["integration/helper", "integration/inventory.json", "integration/workers.json", "ui/cgi/api.cgi", windowPath].includes(path)))
+            if (entry.type !== "File" || !(path.startsWith("integration/workers/") || ["authorization/manifest.json", "integration/helper", "integration/inventory.json", "integration/workers.json", "ui/cgi/api.cgi", windowPath].includes(path)))
                 return;
             const limit = ["integration/helper", "ui/cgi/api.cgi"].includes(path) ? 64 * 1024 * 1024 : 1024 * 1024;
             if (files.has(path) || entry.size > limit) {
@@ -51,13 +53,17 @@ export async function inspectHelper(dir, info, findings, daemon = false) {
             !bytes("ui/cgi/api.cgi").includes(Buffer.from(raw)))
             throw new Error("payload/compiled inventory mismatch");
         const workers = bytes("integration/workers.json");
-        const registry = JSON.parse(workers.toString("utf8"));
-        if (!Array.isArray(registry) || registry.length > 16 || sha256(workers) !== i.registryDigest || JSON.stringify(registry) !== workers.toString("utf8"))
+        const rawRegistry = JSON.parse(workers.toString("utf8"));
+        const sdkRegistry = !Array.isArray(rawRegistry);
+        const registry = sdkRegistry ? decodeSDKRegistry(workers).inert : rawRegistry;
+        if (sdkRegistry && (i.protocol !== 2 || i.dataAccess !== "relaxed" || !helper.includes(workers)))
+            throw new Error("compiled SDK registry mismatch");
+        if (!Array.isArray(registry) || registry.length > 16 || sha256(workers) !== i.registryDigest || (!sdkRegistry && JSON.stringify(registry) !== workers.toString("utf8")))
             throw new Error("invalid registry");
         let previous = "", total = 0;
         for (const worker of registry) {
             if (!worker || Object.keys(worker).sort().join(",") !== "digest,id" || typeof worker.id !== "string" ||
-                !/^[a-z][a-z0-9_]{0,31}$/.test(worker.id) || (previous && previous.localeCompare(worker.id, "en") >= 0) ||
+                !/^[a-z][a-z0-9_]{0,31}$/.test(worker.id) || (previous && (sdkRegistry ? previous >= worker.id : previous.localeCompare(worker.id, "en") >= 0)) ||
                 !/^[a-f0-9]{64}$/.test(worker.digest))
                 throw new Error("invalid worker");
             const content = bytes(`integration/workers/${worker.id}`);
@@ -68,9 +74,18 @@ export async function inspectHelper(dir, info, findings, daemon = false) {
         }
         if ([...files.keys()].filter(p => p.startsWith("integration/workers/")).length !== registry.length)
             throw new Error("unregistered worker");
-        const manifest = { package: i.package, spkVersion: i.version, integration: { protocol: i.protocol, workers: {} } };
+        const manifest = { package: i.package, spkVersion: i.version, privilege: "root", integration: { protocol: i.protocol, workers: {} } };
         const tasks = JSON.parse(/\.rootTasks = (\[[^\n]+\]);/.exec(bytes(windowPath).toString("utf8"))?.[1] ?? "null");
-        const expected = rootTasks({ ...manifest, rootOps: helperOps(manifest, i) });
+        const originalOps = helperOps(manifest, i);
+        let expected = rootTasks({ ...manifest, rootOps: originalOps });
+        // Existing CLI 0.5 archives have inline hash-pinned helper tasks. New
+        // bootstrap archives carry an additional independently inspected inventory.
+        if (files.has("authorization/manifest.json")) {
+            const plan = JSON.parse(bytes("authorization/manifest.json").toString("utf8"));
+            if (JSON.stringify(plan.inventory.operations.filter((op) => op.name.startsWith("helper_"))) !== JSON.stringify(originalOps))
+                throw new Error("bootstrap helper binding mismatch");
+            expected = rootTasks({ ...manifest, rootOps: bootstrapOps({ ...manifest, rootOps: originalOps }, plan.bootstrapSha256) });
+        }
         if (!Array.isArray(tasks) || JSON.stringify(tasks.filter(t => t.op?.startsWith("helper_"))) !== JSON.stringify(expected))
             throw new Error("approved task mismatch");
         // Daemon lifecycle is verified separately with the complete daemon config.

package/dist/standalone/inspect-spk.d.ts

@@ -1,5 +1,5 @@
 import { type IntegrationInspection } from "./inspect-helper.js";
-export type SpkKind = "native-go" | "binary" | "container";
+export type SpkKind = "native-go" | "binary" | "container" | "native-layout";
 export interface SpkInspection {
     kind?: SpkKind;
     package?: string;

package/dist/standalone/inspect-spk.js

@@ -1,11 +1,21 @@
-import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
+import { inspectAuthorization } from "./authorization.js";
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import * as tar from "tar";
+import { familyOfArchToken, NATIVE_ARCH_FAMILIES } from "../build-spk/dsm-arch.js";
+import { CONTAINER_MIN_DSM, isDsmAtLeast } from "../build-spk/dsm-version.js";
+import { ELF_MACHINE } from "./binary.js";
 import { CGI_PAYLOAD_PATH } from "./dsm-window.js";
 import { daemonConfig, readDaemon } from "./daemon.js";
+import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundControl, renderBackgroundUnit } from "./background.js";
+import { renderStandaloneResource } from "./resource.js";
+import { recoverSharedFolder, renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps, SHARED_FOLDER_MARKER } from "./shared-folder.js";
+import { renderInstallWizardFiles, renderNativeInstallWizard } from "../build-spk/install-wizard.js";
 import { renderStandaloneScript } from "./lifecycle.js";
+import { listPortExposures, loadCompose } from "../compose/analyze.js";
 import { inspectHelper } from "./inspect-helper.js";
+import { inspectNativeLayout } from "./native-layout.js";
 const ROOT_SCRIPT_HINTS = [/\bsudo\b/, /\bchown\s+(-\w+\s+)*root\b/, /chmod\s+[ugo]*\+s\b/, /chmod\s+[2467][0-7]{3}\b/];
 /** Reads an SPK without installing it and reports how it would run on DSM. */
 export async function inspectStandaloneSpk(spkPath) {
@@ -17,26 +27,67 @@ export async function inspectSpk(spkPath, expectedKind) {
     try {
         await tar.x({ file: spkPath, cwd: dir });
         const findings = [];
+        if (!expectedKind && existsSync(join(dir, "native-layout.json"))) {
+            const findings = [];
+            const info = Object.fromEntries(readFileSync(join(dir, "INFO"), "utf8").split("\n").flatMap(line => {
+                const m = line.match(/^([a-z_]+)="([^"\r\n]*)"$/);
+                return m ? [[m[1], m[2]]] : [];
+            }));
+            const payload = await listPayload(join(dir, "package.tgz"), findings);
+            const target = join(dir, "layout-inspection");
+            mkdirSync(target);
+            await tar.x({ file: join(dir, "package.tgz"), cwd: target });
+            findings.push(...inspectNativeLayout(dir, target, info));
+            for (const key of ["package", "version", "arch", "os_min_ver", "checksum"])
+                if (!info[key])
+                    findings.push(`Missing INFO ${key}`);
+            return { kind: "native-layout", package: info.package, version: info.version, arch: info.arch, signed: existsSync(join(dir, "syno_signature.asc")), payload, findings };
+        }
         const payload = await listPayload(join(dir, "package.tgz"), findings);
         const paths = new Set(payload.map(entry => entry.path));
         const kind = expectedKind ?? (paths.has(CGI_PAYLOAD_PATH) ? "native-go"
             : paths.has("native.yaml") ? "binary" : paths.has("compose.yaml") ? "container" : "native-go");
-        const identityPayload = [CGI_PAYLOAD_PATH, "integration/helper", "integration/inventory.json", "integration/workers.json", "integration/identity/app.mjs"].every(path => paths.has(path));
+        const helperPayload = ["integration/helper", "integration/inventory.json", "integration/workers.json"].every(path => paths.has(path));
+        const identityPayload = [CGI_PAYLOAD_PATH, "integration/identity/app.mjs"].every(path => paths.has(path)) && (helperPayload || !paths.has("integration/helper"));
         const info = readInfo(join(dir, "INFO"), findings, kind, identityPayload);
         if (kind === "native-go" && paths.has("integration/helper") && info.precheckstartstop !== "yes") {
             findings.push('integration INFO 必須明確設定 precheckstartstop="yes"，否則 DSM 不執行 prestop');
         }
-        checkConf(dir, findings, kind);
+        await checkArch(dir, info, kind, paths.has(CGI_PAYLOAD_PATH), findings);
+        const background = kind === "native-go" && paths.has(BACKGROUND_WORKER_PAYLOAD);
+        const sharedFolder = kind === "native-go" ? recoverSharedFolder(readOptional(join(dir, "scripts/postinst"))) : undefined;
+        checkConf(dir, findings, kind, background, sharedFolder, info.package);
         checkScripts(dir, findings);
+        if (kind === "native-go")
+            checkSharedFolder(dir, findings, info.package, sharedFolder);
+        checkUninstall(dir, findings);
+        if (kind === "container")
+            await checkContainerExposure(dir, join(dir, "package.tgz"), findings);
+        if (background)
+            checkBackground(dir, info, payload, findings);
         if (kind === "native-go")
             await checkDaemon(dir, info, paths, payload, findings);
         let integration;
-        if ([...paths].some(path => path.startsWith("integration/"))) {
+        const integrationPaths = [...paths].filter(path => path.startsWith("integration/"));
+        if (integrationPaths.length > 0 && paths.has("integration/helper")) {
             if (kind !== "native-go" || payload.find(p => p.path === "integration/helper")?.mode !== "0755")
                 findings.push("integration 必須有 native-go executable helper");
             else if (!findings.length)
                 integration = await inspectHelper(dir, info, findings, paths.has("daemon/config.json"));
         }
+        else if (integrationPaths.some(path => path !== "integration/identity/app.mjs")) {
+            findings.push("integration 沒有 helper 時只可附 integration/identity/app.mjs");
+        }
+        if (info.sdk_root_authorization === "2" || [...paths].some(path => path.startsWith("authorization/"))) {
+            if (info.sdk_root_authorization !== "2")
+                findings.push("root authorization INFO marker missing");
+            const authDir = join(dir, "authorization-inspection");
+            mkdirSync(authDir);
+            await tar.x({ file: join(dir, "package.tgz"), cwd: authDir });
+            findings.push(...inspectAuthorization(authDir, info.package, info.version));
+            if (payload.find(p => p.path === "authorization/bootstrap")?.mode !== "0755")
+                findings.push("authorization bootstrap must be executable");
+        }
         const cgiEntry = payload.find((entry) => entry.path === CGI_PAYLOAD_PATH);
         if (kind === "native-go" && !cgiEntry) {
             findings.push(`payload 沒有 ${CGI_PAYLOAD_PATH}`);
@@ -60,6 +111,39 @@ export async function inspectSpk(spkPath, expectedKind) {
         rmSync(dir, { recursive: true, force: true });
     }
 }
+const OS_MIN_VER = /^7\.\d+(\.\d+)?-\d+$/;
+/** INFO os_min_ver and arch must be values DSM accepts, and arch must match the shipped CGI. */
+async function checkArch(dir, info, kind, hasCgi, findings) {
+    if (info.os_min_ver && !OS_MIN_VER.test(info.os_min_ver)) {
+        findings.push(`INFO os_min_ver「${info.os_min_ver}」不是 DSM 7 的 <版本>-<build>（例如 7.1-42661）`);
+    }
+    else if (kind === "container" && info.os_min_ver && !isDsmAtLeast(info.os_min_ver, CONTAINER_MIN_DSM)) {
+        findings.push(`INFO os_min_ver「${info.os_min_ver}」低於容器 App 需要的 DSM ${CONTAINER_MIN_DSM}；docker-project／Container Manager 從 DSM 7.2.1 才有，在更早的 DSM 會安裝但無法啟動`);
+    }
+    const tokens = (info.arch ?? "").split(" ").filter(Boolean);
+    if (tokens.length === 0 || tokens.includes("noarch"))
+        return;
+    for (const token of tokens.filter(token => !familyOfArchToken(token))) {
+        findings.push(`INFO arch 含未知的 platform「${token}」`);
+    }
+    const families = new Set(tokens.map(familyOfArchToken).filter(family => family !== undefined));
+    if (families.size > 1) {
+        findings.push(`INFO arch 混用多個架構（${[...families].join("、")}）；一個 SPK 只含一種架構的 binary`);
+    }
+    if (kind !== "native-go" || !hasCgi || families.size !== 1)
+        return;
+    const [declared] = families;
+    const cgi = join(dir, "cgi-inspection");
+    mkdirSync(cgi);
+    // Only the header is read; the CGI is never run.
+    await tar.x({ file: join(dir, "package.tgz"), cwd: cgi, filter: path => path.replace(/^\.\//, "") === CGI_PAYLOAD_PATH });
+    const header = readFileSync(join(cgi, CGI_PAYLOAD_PATH)).subarray(0, 20);
+    const machine = header.length === 20 && header.toString("latin1", 0, 4) === "\x7fELF" ? header.readUInt16LE(18) : undefined;
+    const actual = NATIVE_ARCH_FAMILIES.find(family => ELF_MACHINE[family] === machine);
+    if (actual && actual !== declared) {
+        findings.push(`INFO arch 宣告 ${declared}，但 ${CGI_PAYLOAD_PATH} 是 ${actual} 的執行檔`);
+    }
+}
 async function checkDaemon(dir, info, paths, payload, findings) {
     if (![...paths].some(path => path.startsWith("daemon/")))
         return;
@@ -81,7 +165,7 @@ async function checkDaemon(dir, info, paths, payload, findings) {
             throw new Error("invalid config");
         if (payload.find(p => p.path === `daemon/payload/${daemon.exec}`)?.mode !== "0755")
             throw new Error("missing executable");
-        const manifest = { package: info.package, daemon, ...(paths.has("integration/helper") ? { integration: {} } : {}) };
+        const manifest = { package: info.package, daemon, ...(paths.has("integration/helper") ? { integration: {}, privilege: "root" } : {}) };
         if (readFileSync(join(unpacked, "daemon/config.json"), "utf8") !== daemonConfig(manifest))
             throw new Error("non-canonical daemon config");
         for (const hook of ["start-stop-status", "preupgrade", "preuninst"]) {
@@ -121,11 +205,34 @@ function readInfo(path, findings, kind, identityPayload) {
     }
     return info;
 }
-function checkConf(dir, findings, kind) {
+/** A container App must not be reachable without DSM sign-in: loopback ports only, no anonymous portal. */
+async function checkContainerExposure(dir, packageTgz, findings) {
+    const extracted = join(dir, "payload");
+    mkdirSync(extracted);
+    await tar.x({ file: packageTgz, cwd: extracted, filter: path => path.replace(/^\.\//, "") === "compose.yaml" });
+    const compose = loadCompose(join(extracted, "compose.yaml"))?.compose;
+    for (const exposure of compose ? listPortExposures(compose).filter(e => !e.loopbackOnly) : []) {
+        findings.push(`CONTAINER_PORT_EXPOSED ${exposure.service}: ${exposure.entry} 綁在所有網路介面，可不經 DSM 驗證直接連線；請改綁 127.0.0.1`);
+    }
+    try {
+        if (JSON.parse(readFileSync(join(dir, "conf", "resource"), "utf8")).webservice) {
+            findings.push("CONTAINER_ANONYMOUS_PORTAL conf/resource 註冊了 Web Station portal，任何人不需登入 DSM 即可開啟（integration.web.access: public）");
+        }
+    }
+    catch { /* checkConf already reports an unreadable conf/resource */ }
+}
+function readOptional(path) {
+    return existsSync(path) ? readFileSync(path, "utf8") : undefined;
+}
+function checkConf(dir, findings, kind, background, sharedFolder, pkg) {
     const confDir = join(dir, "conf");
     const entries = existsSync(confDir) ? readdirSync(confDir) : [];
+    const nativeResource = kind === "native-go" ? renderStandaloneResource({ package: pkg ?? "", ...(background ? { background: { worker: "sha256-v1" } } : {}), ...(sharedFolder ? { sharedFolder } : {}) }) : undefined;
+    if (nativeResource !== undefined && readOptional(join(confDir, "resource")) !== nativeResource) {
+        findings.push(`conf/resource 必須是 ${nativeResource}（只有官方 data-share 與 systemd-user-unit，且與 install.sharedFolder 宣告一致）`);
+    }
     for (const name of entries) {
-        if (name !== "privilege" && !(kind === "container" && name === "resource")) {
+        if (name !== "privilege" && !(kind === "container" && name === "resource") && !(nativeResource !== undefined && name === "resource") && !(background && name === "systemd")) {
             findings.push(`conf/${name} 會向 DSM 註冊額外資源；Standalone Package 不產生它`);
         }
     }
@@ -165,6 +272,57 @@ function checkConf(dir, findings, kind) {
         }
     }
 }
+/** The opt-in package user unit must be exactly what the generator writes. */
+function checkBackground(dir, info, payload, findings) {
+    const pkg = info.package;
+    if (!pkg)
+        return;
+    const read = (path) => existsSync(join(dir, path)) ? readFileSync(join(dir, path), "utf8") : undefined;
+    if (payload.find(p => p.path === BACKGROUND_WORKER_PAYLOAD)?.mode !== "0755")
+        findings.push(`${BACKGROUND_WORKER_PAYLOAD} 缺少或非 executable`);
+    const units = existsSync(join(dir, BACKGROUND_UNIT_DIR)) ? readdirSync(join(dir, BACKGROUND_UNIT_DIR)) : [];
+    const unit = backgroundUnitName(pkg);
+    if (units.length !== 1 || units[0] !== unit || read(`${BACKGROUND_UNIT_DIR}/${unit}`) !== renderBackgroundUnit(pkg)) {
+        findings.push(`${BACKGROUND_UNIT_DIR} 必須只有固定的 ${unit}（套件帳號執行，無 User=、無 root）`);
+    }
+    if (read("scripts/start-stop-status") !== renderBackgroundControl(pkg))
+        findings.push("background scripts/start-stop-status 與固定 synosystemctl lifecycle 不符");
+}
+/**
+ * `install.sharedFolder` is recovered from the postinst marker. The install
+ * and upgrade wizards must then be exactly what the generator writes for that
+ * declaration (without one, any present file must be the default native
+ * install wizard), and no other install/upgrade wizard file may exist.
+ */
+function checkSharedFolder(dir, findings, pkg, folder) {
+    const wizardDir = join(dir, "WIZARD_UIFILES");
+    const present = (existsSync(wizardDir) ? readdirSync(wizardDir) : []).filter(name => /^(install|upgrade)_uifile(_|\.|$)/.test(name)).sort();
+    const postinst = readOptional(join(dir, "scripts/postinst"));
+    if (!folder && postinst?.includes(SHARED_FOLDER_MARKER))
+        findings.push("scripts/postinst 的 install.sharedFolder 宣告無效");
+    if (!pkg)
+        return;
+    const wizards = expectedWizardFiles(pkg, folder);
+    const source = folder ? "install.sharedFolder 宣告" : "native-go 預設安裝精靈";
+    // The default native wizard is optional; a declared shared folder needs all of its files.
+    for (const name of folder ? Object.keys(wizards) : present.filter(n => n in wizards)) {
+        if (readOptional(join(wizardDir, name)) !== wizards[name])
+            findings.push(`WIZARD_UIFILES/${name} 與${source}不符`);
+    }
+    for (const name of present.filter(n => !(n in wizards)))
+        findings.push(`WIZARD_UIFILES/${name} 不是${source}產生的精靈檔`);
+    if (!folder)
+        return;
+    for (const hook of ["postinst", "postupgrade"]) {
+        if (readOptional(join(dir, "scripts", hook)) !== renderStandaloneScript(hook, { package: pkg, sharedFolder: folder })) {
+            findings.push(`scripts/${hook} 與 install.sharedFolder 宣告的固定腳本不符`);
+        }
+    }
+}
+function expectedWizardFiles(pkg, folder) {
+    const install = renderInstallWizardFiles(pkg, folder ? sharedFolderInstallSteps(pkg, folder) : renderNativeInstallWizard);
+    return { ...install.static, ...install.dynamic, ...(folder ? renderSharedFolderUpgradeWizardFiles(pkg, folder) : {}) };
+}
 function checkScripts(dir, findings) {
     const scriptsDir = join(dir, "scripts");
     if (!existsSync(join(scriptsDir, "start-stop-status"))) {
@@ -177,6 +335,52 @@ function checkScripts(dir, findings) {
         }
     }
 }
+const DATA_KEYS = ["pkgwizard_remove_additional", "delete_app_data"];
+const DELETE_COMMAND = /\brm\s+-[a-zA-Z]*[rR]|\bfind\b[^\n]*(-delete|-exec\s+rm)/;
+const UPGRADE_GUARD = /SYNOPKG_PKG_STATUS[^\n]*!=\s*"?UPGRADE"?/;
+function uninstallBoxes(file) {
+    try {
+        const steps = JSON.parse(readFileSync(file, "utf8"));
+        return steps.flatMap(step => step.items ?? []).flatMap(item => item.subitems ?? []).filter(box => DATA_KEYS.includes(box.key));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Deleting app data on uninstall is only safe when it is opt-in, skipped on
+ * upgrade (DSM replays postuninst for the old version) and confined to this
+ * package's own `/volumeN/@app*` directories; the wizard and the script must
+ * agree on the box that asks for it.
+ */
+function checkUninstall(dir, findings) {
+    const script = join(dir, "scripts", "postuninst");
+    if (!existsSync(script))
+        return;
+    const body = readFileSync(script, "utf8");
+    const wizardDir = join(dir, "WIZARD_UIFILES");
+    const wizards = existsSync(wizardDir) ? readdirSync(wizardDir).filter(name => name === "uninstall_uifile" || name.startsWith("uninstall_uifile_")).sort() : [];
+    const boxes = wizards.flatMap(name => uninstallBoxes(join(wizardDir, name)).map(box => ({ ...box, name })));
+    const deletes = DELETE_COMMAND.test(body);
+    if (deletes) {
+        if (!UPGRADE_GUARD.test(body))
+            findings.push('UNINSTALL_NO_UPGRADE_GUARD scripts/postuninst 刪除資料但沒有 [ "$SYNOPKG_PKG_STATUS" != UPGRADE ] 防護，升級時會誤刪');
+        if (!/is_package_area\(\)\s*\{/.test(body) || !/if ! is_package_area "\$real"/.test(body))
+            findings.push("UNINSTALL_UNSAFE_DELETE scripts/postuninst 刪除的路徑沒有驗證落在 /volumeN/@appdata|@apphome|@appstore/<package>；變數為空或指向別處時會刪錯資料");
+        for (const line of body.split("\n").filter(l => DELETE_COMMAND.test(l))) {
+            for (const path of line.match(/\/volume\w*\/(?!@app(data|home|store)\/)[^\s"'$;]*/g) ?? [])
+                findings.push(`UNINSTALL_UNSAFE_DELETE scripts/postuninst 刪除 ${path}，不在套件自己的 @app* 目錄內`);
+        }
+        if (!boxes.some(box => box.name === "uninstall_uifile"))
+            findings.push("UNINSTALL_WIZARD_MISSING postuninst 會刪除資料，但 WIZARD_UIFILES/uninstall_uifile 沒有 pkgwizard_remove_additional 勾選框，使用者無法選擇");
+    }
+    for (const box of boxes) {
+        if (box.defaultValue !== false)
+            findings.push(`UNINSTALL_WIZARD_DEFAULT_CHECKED WIZARD_UIFILES/${box.name} 的 ${box.key} 預設必須不勾（保留資料）`);
+        if (!body.includes(box.key))
+            findings.push(`UNINSTALL_WIZARD_NOT_HONOURED WIZARD_UIFILES/${box.name} 提供 ${box.key} 勾選框，但 scripts/postuninst 沒有讀它`);
+    }
+}
 async function listPayload(packageTgz, findings) {
     if (!existsSync(packageTgz)) {
         findings.push("缺少 package.tgz");

package/dist/standalone/job-diagnostics.d.ts

@@ -0,0 +1 @@
+export declare function formatJobDiagnostic(raw: string | Uint8Array): string;

package/dist/standalone/job-diagnostics.js

@@ -0,0 +1,49 @@
+import { strictJSON } from './worker-contract-json.js';
+const WORKER_SAFE_REASONS = ['invalid-request', 'incompatible', 'unsupported', 'replay', 'stale', 'expired', 'denied', 'unavailable', 'suspended', 'revoked', 'fenced', 'busy', 'limit-exceeded', 'canceled', 'timeout', 'partial', 'commit-uncertain', 'cleanup-required', 'internal'];
+// S5 formatter only: no command registration, network, SSH or raw-log reader.
+// Reject the whole projection on schema/serializer failure; never echo input.
+export function formatJobDiagnostic(raw) {
+    try {
+        const record = (value, required, optional = []) => {
+            if (!value || typeof value !== 'object' || Array.isArray(value))
+                throw 0;
+            const o = value;
+            if (required.some(k => !Object.hasOwn(o, k)) || Object.keys(o).some(k => !required.includes(k) && !optional.includes(k)))
+                throw 0;
+            return o;
+        };
+        const d = record(strictJSON(raw, 32768), ['diagnosticSchema', 'availability', 'jobs', 'total', 'truncated']);
+        if (d.diagnosticSchema !== 1 || d.availability !== 'unavailable' || !Array.isArray(d.jobs) || d.jobs.length > 10 || !Number.isSafeInteger(d.total) || d.total < d.jobs.length || d.total > 256 || typeof d.truncated !== 'boolean' || d.truncated !== (d.total > d.jobs.length))
+            throw 0;
+        const aliases = new Set();
+        const jobs = d.jobs.map(value => {
+            const j = record(value, ['alias', 'state', 'cancelRequested', 'drained', 'effectsUnknown'], ['safeReason']);
+            if (typeof j.alias !== 'string' || !/^[a-f0-9]{64}$/.test(j.alias) || !['pending', 'running', 'cancel-requested', 'draining', 'succeeded', 'failed', 'canceled', 'interrupted', 'cleanup-required'].includes(j.state))
+                throw 0;
+            if (['cancelRequested', 'drained', 'effectsUnknown'].some(k => typeof j[k] !== 'boolean'))
+                throw 0;
+            if (j.safeReason !== undefined && !WORKER_SAFE_REASONS.includes(j.safeReason))
+                throw 0;
+            if (aliases.has(j.alias))
+                throw 0;
+            aliases.add(j.alias);
+            if (j.state === 'succeeded' && (!j.drained || j.cancelRequested || j.effectsUnknown || j.safeReason !== undefined))
+                throw 0;
+            if (['pending', 'running'].includes(j.state) && (j.drained || j.cancelRequested))
+                throw 0;
+            if (['cancel-requested', 'draining'].includes(j.state) && (!j.cancelRequested || j.drained))
+                throw 0;
+            if (j.state === 'cleanup-required' && (j.drained || j.safeReason !== 'cleanup-required'))
+                throw 0;
+            if (['failed', 'interrupted', 'canceled'].includes(j.state) && j.safeReason === undefined)
+                throw 0;
+            if (j.state === 'canceled' && !j.cancelRequested)
+                throw 0;
+            return { alias: j.alias, state: j.state, ...(j.safeReason === undefined ? {} : { safeReason: j.safeReason }), cancelRequested: j.cancelRequested, drained: j.drained, effectsUnknown: j.effectsUnknown };
+        });
+        return JSON.stringify({ diagnosticSchema: 1, availability: 'unavailable', jobs, total: d.total, truncated: d.truncated }) + '\n';
+    }
+    catch {
+        return '{"safeReason":"invalid-request"}\n';
+    }
+}

package/dist/standalone/lifecycle-helper.d.ts

@@ -1,2 +1,2 @@
 /** Non-privileged management veto shared by the generated package hooks. */
-export declare function renderHelperStoppedCheck(packageId: string): string;
+export declare function renderHelperStoppedCheck(packageId: string, revoke?: boolean): string;

package/dist/standalone/lifecycle-helper.js

@@ -1,6 +1,6 @@
 /** Non-privileged management veto shared by the generated package hooks. */
-export function renderHelperStoppedCheck(packageId) {
-    return `/var/packages/${packageId}/target/integration/helper check-stopped || {
+export function renderHelperStoppedCheck(packageId, revoke = false) {
+    return `${revoke ? `/var/packages/${packageId}/target/integration/helper revoke && ` : ''}/var/packages/${packageId}/target/integration/helper check-stopped || {
   message='Run the approved helper_teardown or helper_disable operation before stopping, upgrading or uninstalling.'
   printf '%s\\n' "$message" >&2
   if [ -n "\${SYNOPKG_TEMP_LOGFILE:-}" ]; then

package/dist/standalone/lifecycle.d.ts

@@ -1,3 +1,3 @@
 import type { StandaloneManifest } from "./manifest.js";
-/** Non-privileged hooks: precheck gates DSM management; no hook tears down root. */
+/** Package-UID hooks: root auth withdraws via the trusted socket, then retains the stopped veto. */
 export declare function renderStandaloneScript(name: string, manifest: StandaloneManifest): string;