@synopackageland/cli 0.5.0 → 0.6.0

package/dist/standalone/spk.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
-import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync, } from "node:fs";
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join, relative, isAbsolute } from "node:path";
+import { dirname, join } from "node:path";
 import { infoArchValue } from "../build-spk/dsm-arch.js";
 import { writeDsmWindowIcons, writePackageCenterIcons } from "../build-spk/dsm-icons.js";
 import { renderNativePrivilege } from "../build-spk/native-lifecycle.js";
@@ -12,12 +12,12 @@ import { createReproducibleTar } from "../build-spk/reproducible-archive.js";
 import { renderStandaloneScript } from "./lifecycle.js";
 import { DSM_LANGS, LOCALES } from "./i18n.js";
 import { CGI_PAYLOAD_PATH, renderUiConfig, renderWindowScript, windowScriptName } from "./dsm-window.js";
-import { hasHelper, inertWorkerRegistry } from "./helper-inventory.js";
 import { copyStandaloneNotices } from "../build-spk/notices.js";
 import { hostScriptName, renderHostAdapterScript } from "./host-adapter.js";
 import { copyDaemonPayload } from "./daemon.js";
 import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit } from "./background.js";
 import { renderStandaloneResource } from "./resource.js";
+import { executorPlan } from "../runtime/executor-build.js";
 import { renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps } from "./shared-folder.js";
 const FILE_MODE = 0o644;
 const EXEC_MODE = 0o755;
@@ -41,12 +41,14 @@ export class StandaloneBuildError extends Error {
 /**
  * Packs an unsigned Standalone Package SPK. DSM runs installation/lifecycle
  * as the package account, including an optional foreground daemon. Root
- * integration remains separate and requires explicit administrator approval.
+ * authorization remains separate and requires explicit administrator approval.
  */
 export async function assembleStandaloneSpk(options) {
     const { manifest } = options;
     const staging = mkdtempSync(join(tmpdir(), "syno-standalone-spk-"));
     try {
+        if ((manifest.capabilities.rootOps || manifest.capabilities.delegate) && !options.executor)
+            throw new StandaloneBuildError("EXECUTOR_PIN_REQUIRED", "Executor artifact required.");
         const uiRoot = join(staging, "package", "ui");
         const appDir = join(uiRoot, "app");
         copyUiTree(manifest.ui.dir, appDir);
@@ -64,7 +66,7 @@ export async function assembleStandaloneSpk(options) {
                 throw new StandaloneBuildError("STANDALONE_DAEMON_ARTIFACT_REQUIRED", "daemon controller artifact required.");
             copyDaemonPayload(manifest, options.arch, join(staging, "package", "daemon"), options.daemonControl);
         }
-        if (manifest.background) {
+        if (manifest.capabilities.jobs) {
             if (!options.backgroundWorker)
                 throw new StandaloneBuildError("STANDALONE_BACKGROUND_ARTIFACT_REQUIRED", "background worker artifact required.");
             const worker = join(staging, "package", BACKGROUND_WORKER_PAYLOAD);
@@ -72,45 +74,33 @@ export async function assembleStandaloneSpk(options) {
             copyFileSync(options.backgroundWorker, worker);
             chmodSync(worker, EXEC_MODE);
         }
-        if (hasHelper(manifest) && !options.helper)
-            throw new StandaloneBuildError("HELPER_ARTIFACT_REQUIRED", "integration SPK 缺少已建置的 helper inventory。");
-        if (options.helper) {
-            const dir = join(staging, "package", "integration");
-            mkdirSync(dir, { recursive: true });
-            copyFileSync(options.helper.binary, join(dir, "helper"));
-            copyFileSync(new URL("../../templates/native-go/backend/THIRD_PARTY_NOTICES.txt", import.meta.url), join(dir, "THIRD_PARTY_NOTICES.txt"));
-            chmodSync(join(dir, "helper"), EXEC_MODE);
-            writeFile(join(dir, "inventory.json"), JSON.stringify(options.helper.inventory));
-            writeFile(join(dir, "workers.json"), options.helper.registry ?? inertWorkerRegistry(options.helper.workers));
-            mkdirSync(join(dir, "workers"));
-            for (const worker of options.helper.workers) {
-                writeFileSync(join(dir, "workers", worker.id), worker.bytes, { mode: FILE_MODE });
-            }
-        }
-        if (manifest.integration?.identity === "better-auth") {
-            const source = join(manifest.root, "node", "dist", "app.mjs");
-            const rel = relative(realpathSync(manifest.root), realpathSync(source));
-            if (rel.startsWith("..") || isAbsolute(rel) || !lstatSync(source).isFile() || lstatSync(source).size > 16 * 1024 * 1024)
-                throw new StandaloneBuildError("STANDALONE_IDENTITY_PAYLOAD_INVALID", "Better Auth bundle must be a bounded regular file inside the project.");
-            const target = join(staging, "package", "integration", "identity", "app.mjs");
-            mkdirSync(dirname(target), { recursive: true });
-            copyFileSync(source, target);
-            chmodSync(target, FILE_MODE);
-        }
-        copyStandaloneNotices(manifest.root, manifest.ui.dir, join(staging, 'package'), manifest.backend.kind === 'go' || Boolean(manifest.daemon), Boolean(options.helper), manifest.integration?.identity === 'better-auth', manifest.backend.kind === 'go' ? manifest.backend.dir : undefined);
+        copyStandaloneNotices(manifest.root, manifest.ui.dir, join(staging, 'package'), manifest.backend.kind === 'go' || Boolean(manifest.daemon), manifest.backend.kind === 'go' ? manifest.backend.dir : undefined);
         if (manifest.daemon)
             copyFileSync(new URL('../../templates/_shared/LICENSES/TEMPLATE.txt', import.meta.url), join(staging, 'package', 'LICENSES', 'DAEMON-LICENSE.txt'));
+        if (options.executor) {
+            const executorDir = join(staging, "package", "executor");
+            mkdirSync(executorDir);
+            copyFileSync(options.executor.binary, join(executorDir, "executor"));
+            chmodSync(join(executorDir, "executor"), EXEC_MODE);
+            copyFileSync(options.executor.lifecycleBinary, join(executorDir, "lifecycle"));
+            chmodSync(join(executorDir, "lifecycle"), EXEC_MODE);
+            writeFile(join(executorDir, "policy.json"), options.executor.policyText);
+            writeFile(join(executorDir, "setup.json"), JSON.stringify(executorPlan(options.executor)));
+            for (const op of manifest.rootOps ?? [])
+                writeFile(join(staging, "package", "root", op.name + ".sh"), op.body);
+        }
         const packageTgz = join(staging, "package.tgz");
         await createReproducibleTar(join(staging, "package"), packageTgz, { gzip: true });
         rmSync(join(staging, "package"), { recursive: true, force: true });
         const checksum = createHash("md5").update(readFileSync(packageTgz)).digest("hex");
+        writeFile(join(staging, "sdk-package.json"), JSON.stringify({ schema: 2, backend: manifest.backend.kind, capabilities: Object.keys(manifest.capabilities).sort() }));
         writeFile(join(staging, "INFO"), renderInfo(manifest, options.arch, checksum));
         mkdirSync(join(staging, "conf"));
         writeFile(join(staging, "conf", "privilege"), renderNativePrivilege());
         const resource = renderStandaloneResource(manifest);
         if (resource)
             writeFile(join(staging, "conf", "resource"), resource);
-        if (manifest.background) {
+        if (manifest.capabilities.jobs) {
             mkdirSync(join(staging, BACKGROUND_UNIT_DIR), { recursive: true });
             writeFile(join(staging, BACKGROUND_UNIT_DIR, backgroundUnitName(manifest.package)), renderBackgroundUnit(manifest.package));
         }
@@ -124,7 +114,7 @@ export async function assembleStandaloneSpk(options) {
             ...install.static,
             ...install.dynamic,
             ...(folder ? renderSharedFolderUpgradeWizardFiles(manifest.package, folder) : {}),
-            ...renderUninstallWizardFiles(manifest.package, "native", { integration: hasHelper(manifest) }),
+            ...renderUninstallWizardFiles(manifest.package, "native", { executor: Boolean(options.executor) }),
         });
         writePackageCenterIcons(staging);
         mkdirSync(dirname(options.outputPath), { recursive: true });
@@ -135,6 +125,7 @@ export async function assembleStandaloneSpk(options) {
     }
 }
 function writeFile(path, content, mode = FILE_MODE) {
+    mkdirSync(dirname(path), { recursive: true });
     writeFileSync(path, content, "utf8");
     chmodSync(path, mode);
 }
@@ -157,10 +148,8 @@ function renderInfo(manifest, arch, checksum) {
         ["startable", "yes"],
         ["checksum", checksum],
     ];
-    if (hasHelper(manifest) || manifest.daemon)
+    if (manifest.daemon)
         fields.push(["precheckstartstop", "yes"]);
-    if (manifest.integration?.identity === "better-auth")
-        fields.push(["install_dep_packages", "Node.js_v22"]);
     for (const locale of LOCALES) {
         const text = manifest.i18n?.info[locale];
         if (text?.displayname)

package/dist/templates/_executor/README.md

@@ -0,0 +1,204 @@
+# Protected executor
+
+Standalone, standard-library-only Go module. Build with `CGO_ENABLED=0 GOOS=linux
+GOARCH=amd64|arm64 go build -trimpath -o executor .`. No network listener: the
+package account uses `/run/synopkgland/<package>/executor.sock` (one JSON line,
+including newline at most 65536 bytes). Socket access additionally requires exact
+Linux SO_PEERCRED UID equality, even for another member of the package group.
+Non-Linux builds support portable tests and refuse privileged service operations.
+
+## Protected inventory and policy
+
+Setup must copy the digest-pinned executor, policy and root scripts into:
+
+```
+/usr/local/etc/synopkgland/<package>/             root:root 0700
+  runtime/                                     root:root 0700
+    executor                                   root:root 0700
+    policy.json                                root:root 0600
+    tasks.json                                 root:root 0600 (verified setup task inventory)
+    root/<name>.sh                             root:root 0600
+  delegations/                                 root:root 0700
+    <random-256-bit-id>.json                    root:root 0600
+    executor.pid                               root:root 0600
+    executor.log                               root:root 0600 (control start)
+```
+
+The runtime location is mandatory; `control purge` removes this package's entire
+protected inventory after stopping it. The parent `/usr/local/etc/synopkgland`
+may be root:root 0755. Ancestors must be root-owned and not group/world writable;
+symlinks and writable runtime files are refused. Neither package-owned `etc` nor
+package `var` is trusted for executor code or delegation storage. The chosen path
+was measured on vt-nas DSM 7.4; survival of future DSM updates remains unverified.
+
+`policy.json` has this strict schema (no unknown keys):
+
+```json
+{
+  "v": 1,
+  "package": "com.example.downloader",
+  "app": "com.example.downloader.Application",
+  "scope": "home",
+  "operations": [
+    "status", "delegate.create", "delegate.list", "delegate.revoke",
+    "files.list", "files.info", "files.createFolder",
+    "files.checkPermission", "files.write", "root.run"
+  ],
+  "root": {"whoami": "<64 lowercase hexadecimal SHA-256 digits>"}
+}
+```
+
+`app` is the actual registered DSM AppPriv application ID, not a guessed package
+ID. DSM 7.x omits default-allowed Apps from AppPriv preview; an absent
+entry in a valid applications array is allowed. Explicit deny/custom, duplicate
+entries and malformed responses are refused. Account eligibility is rechecked
+independently, so absence never bypasses a disabled account. `scope` is the
+manifest's fixed `home` or `shared:<share-name>`; omit it for root-only packages.
+`operations` includes every permitted ID, including management and status IDs;
+no implicit allowlist exemptions. `root` is omitted when root operations are
+disabled. Only names in this digest map can execute. Setup pins policy bytes and
+all root scripts; no policy data comes from the package socket. The caller authentication pair follows the coordinator-approved v6 update to PLAN §2.4.
+
+## Requests
+
+Every request: `{"v":1,"op":"...","auth":{},"params":{...}}` followed by
+newline. `auth.dsm_cookie` is only the DSM `id` value, never a raw Cookie header.
+Caller requests also require `auth.dsm_synotoken`, forwarded from the current
+HTTP request's X-SYNO-TOKEN or SynoToken header. Both aliases may be present
+when their values match; conflicting aliases or repeated values of either header
+are refused. Local NormalUser verification
+sends both the id cookie and X-SYNO-TOKEN; neither value enters logs or storage.
+Only the executor's local DSM NormalUser HTTP result establishes identity. Other
+identity fields, duplicate JSON keys, invalid UTF-8, unrelated parameters, unknown
+operations and policy-excluded operations are rejected. Replies follow §2.4.
+
+| Operation | Parameters | Result |
+| --- | --- | --- |
+| status | none | executor_digest, policy_digest, version, ready |
+| delegate.create | job_id, ops[], scope, path, ttl_seconds | delegation_id, subject {username, uid}, expires_at (RFC3339) |
+| delegate.list | none | delegations[] with public metadata, including revoked/expired records |
+| delegate.revoke | delegation_id; job_id required without cookie | revoked |
+| files.list, files.info, files.checkPermission | delegation_id, job_id, path | DSM data object |
+| files.createFolder | delegation_id, job_id, path (parent), name | DSM data object |
+| files.write | delegation_id, job_id, staging (relative), dest_dir, name | path |
+| root.run | name | output (stdout and stderr combined) |
+
+Create/list require a cookie and SynoToken. Revoke accepts the subject/admin session pair or a matching
+package job ID. Root operations require the session pair independently verified as an
+active administrators member. Delegated operations recheck the account, UID,
+expired=`normal`, non-admin membership, App and File Station privileges, scope,
+job, operation, expiry and revocation. UIDs below 1024 are excluded as system
+accounts. TTL must be 1–2592000 seconds. No cookie/SynoToken/SID/password is persisted.
+
+Paths use File Station spellings `/home[/...]` or `/<share>[/...]`. A delegation
+binds the requested directory's canonical path. Symlinks resolving outside that
+directory are denied. `files.write` opens package-owned, singly linked regular
+staging files with no symlink components; its fresh child checks setgroups,
+setresgid and setresuid in order, then all real/effective IDs and groups. The child
+opens the destination after dropping identity, verifies its pinned directory and
+scope, and copies into an exclusive hidden `.synopkgland-<job_id>-<random>.part`
+file. After fsync it publishes the complete file with a hard link, then removes
+the temporary name. Existing files and symlinks are never overwritten. The
+executor cleans the exact temporary name as the subject user after a canceled or
+killed child, using a retained directory descriptor; startup performs no scan.
+Successful writes delete staging. DSM ACL inheritance can
+produce a mode different from the requested 0600 (observed 0711 on vt-nas).
+
+File Station CheckPermission uses v3 with a fixed non-overwriting probe filename
+and size zero; it creates no file. Missing/failed API data is denied. DSM output
+and root script output are capped at 1 MiB; commands have 20-second deadlines,
+connection read/write deadlines are 15/5 seconds and request execution is bounded
+by 30 seconds. At most 16 connections are admitted. Execution/revocation are
+serialized. Linux command timeouts kill the entire command process group.
+
+File Station APIs resolve path strings inside DSM after executor scope validation;
+there is no atomic DSM API for binding that subsequent lookup to our directory
+FD. Concurrent subject-controlled directory renames remain a scope-race limitation
+for runner API operations. The writer uses pinned directory descriptors; a user
+can still move a directory after its final scope check. These are release review
+items, not assertions of complete race freedom.
+
+## Lifecycle and checks
+
+```
+executor serve --package com.example.downloader
+executor control start --package com.example.downloader
+executor control stop --package com.example.downloader
+executor control purge --package com.example.downloader
+```
+
+Root control start launches asynchronously; the caller reads socket status to
+establish readiness. A held flock pidfile refuses duplicate serve. Root's pinned
+boot/control start can validate and terminate a previous monitor before launching
+its replacement; package-account start only writes the mailbox and cannot replace
+runtime. Stop pauses the listener while the monitor continues. Purge removes this
+package's protected state and deletes only its verified recorded scheduler tasks.
+
+Run `go test -race ./...` and `bash scripts/ci/gate.sh native-go`. The gate adds
+Linux amd64/arm64 vet, static binary builds and test compilation. Linux-specific
+syscall tests also run on vt-nas from a cross-compiled test executable. The
+`testdata/live_probe.py` harness expects isolated disposable accounts and a
+manually copied runtime, reads passwords only from stdin, and logs no credentials.
+The live harness uses DSM's registered `SYNO.Desktop` AppPriv ID as a stand-in for
+an installed App; installed-package AppPriv integration belongs to setup testing.
+
+
+## Package lifecycle
+
+Package-account hooks atomically write `stop` before upgrades/stops, `start` on
+install/upgrade completion and package start, and `purge` before uninstall.
+`stop` cancels/drains requests and removes the listener without ending the root
+monitor. `start` resumes only if both package executor and policy hashes equal
+the approved runtime pins; otherwise the service stays paused for administrator
+approval. Only root's pinned boot/control path can replace a monitor or runtime.
+
+At start, scheduler readback must exactly match the canonical lifecycle scripts
+regenerated from the package identity and approved executor/policy pins. Package
+setup metadata supplies hints only. The verified names, pins and script hashes
+are stored in root:root 0600 `runtime/tasks.json`. Purge regenerates the scripts
+and revalidates each current definition before EventScheduler v1
+delete (`task_name`) or TaskScheduler v2 delete (`tasks=[{id,real_owner}]`).
+Boot mirrors from TaskScheduler are ignored. Changed, missing, ambiguous or
+unverifiable records are logged and retained for administrator review; protected
+runtime, delegations and sockets are still removed, then the monitor exits.
+An absent process does not block uninstall; the pinned boot task handles pending
+purge or a missing package on the next boot. If the retained binary/policy is
+missing or tampered with, boot refuses execution and requires manual review.
+
+
+The separate package-account `executor/lifecycle` helper writes an atomic 0600
+mailbox request. Stop/purge wait at most 50 seconds for socket disappearance;
+start returns after writing and lets the monitor verify pins asynchronously.
+The helper never calls synowebapi or TaskScheduler. Socket inspection failures
+and timeouts warn and permit lifecycle to continue. Write/validation failures
+remain errors. Delegate hooks attempt worker stop first; a worker stop failure
+warns and still requests executor pause/purge.
+
+The monitor polls every 500 ms with bounded regular-file reads, accepting only
+exact start/stop/purge (optionally one trailing newline). Invalid values are
+ignored and logged without logging contents. The preuninst `purge` mailbox is
+handled immediately; cleanup completes asynchronously. Package directory/INFO
+identity absence is a fallback: the monitor pauses the socket and requests,
+retains runtime/delegations/tasks, and purges only after 10 continuous minutes of
+confirmed absence, even while paused. Every poll checks again; a valid identity
+resets the timer, and an unreadable path cannot count as confirmed absence.
+Reappearance re-reads the mailbox, including an unchanged `start`: matching pins
+resume, changed pins stay paused for administrator approval, `stop` stays paused,
+and `purge` clears state immediately. A root-approved new monitor ignores the
+stop file already present at startup; that exception ends after an absence.
+
+The boot task checks pending purge/package disappearance before accessing source.
+It verifies retained pins and protected copies again before offline purge. Normal
+boot installs verified copies and calls root control start to replace a previous
+monitor. Scripts stay within 1 KiB with no percent characters, including the
+longest package name. Partial/tampered retained state requires administrator
+review. All nine uninstall wizard locales name the two tasks and disclose the
+retained DSM storage/infrastructure. `inspect`/`status` cleanup guidance is
+conditional; it does not claim that remote remnants were observed.
+
+Directories newly created by the executor are explicitly chowned/chmodded through
+a directory descriptor and verified with fstat, so boot umask 0077 cannot reduce
+/run/synopkgland 0755 or its package directory 0750. Existing directories are
+validated and never repaired/adopted. The package directory must already have
+root/package-group ownership. The socket is set to root/package-group 0660 and
+verified using Linux O_PATH + fstat on its filesystem inode.

package/dist/templates/_executor/apppriv_review_test.go

@@ -0,0 +1,28 @@
+package main
+
+import (
+	"context"
+	"testing"
+)
+
+func TestReviewAppPrivRejectsAmbiguousOrError(t *testing.T) {
+	cases := map[string]string{
+		"outer error":                    `{"success":true,"error":{"code":105},"data":{"applications":[]}}`,
+		"inner error":                    `{"success":true,"data":{"applications":[],"error":{"code":105}}}`,
+		"duplicate array hides deny":     `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"deny"}],"applications":[]}}`,
+		"duplicate privilege hides deny": `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"deny","privilelge":"allow"}]}}`,
+		"duplicate app id":               `{"success":true,"data":{"applications":[{"app_id":"other","app_id":"app","privilelge":"allow"}]}}`,
+		"null error":                     `{"success":true,"data":{"applications":[],"error":null}}`,
+		"nonobject entry":                `{"success":true,"data":{"applications":[42]}}`,
+		"nested error":                   `{"success":true,"data":{"applications":[{"app_id":"other","privilelge":"allow","details":{"error":null}}]}}`,
+		"malformed entries":              `{"success":true,"data":{"applications":[null,{}]}}`,
+	}
+	for name, reply := range cases {
+		t.Run(name, func(t *testing.T) {
+			d := &liveDSM{Command: &cmdStub{reply: reply}}
+			if d.Allow(context.Background(), Subject{Username: "alice"}, "app") == nil {
+				t.Fatal("unsafe AppPriv response allowed")
+			}
+		})
+	}
+}

package/dist/templates/_executor/auth_presence_review_test.go

@@ -0,0 +1,38 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+)
+
+func TestReviewEmptyPartialAuthMustNotBecomeWorkerRevoke(t *testing.T) {
+	for _, auth := range []string{`{"dsm_cookie":""}`, `{"dsm_synotoken":""}`, `{"dsm_cookie":"","dsm_synotoken":""}`, `null`} {
+		e, _, _ := setup(t)
+		id := create(t, e)
+		var req Request
+		p, _ := json.Marshal(map[string]string{"delegation_id": id, "job_id": "job1"})
+		raw := []byte(`{"v":1,"op":"delegate.revoke","auth":` + auth + `,"params":` + string(p) + `}`)
+		if err := strictJSON(raw, &req); err != nil {
+			t.Fatal(err)
+		}
+		if r := e.Handle(context.Background(), req); r.Code != "AUTH_DENIED" {
+			t.Errorf("partial auth %s became worker revoke: %+v", auth, r)
+		}
+	}
+}
+
+func TestWorkerRevokeRequiresAbsentOrEmptyAuthObject(t *testing.T) {
+	for _, auth := range []string{"", `,"auth":{}`} {
+		e, _, _ := setup(t)
+		id := create(t, e)
+		p, _ := json.Marshal(map[string]string{"delegation_id": id, "job_id": "job1"})
+		var req Request
+		if err := strictJSON([]byte(`{"v":1,"op":"delegate.revoke"`+auth+`,"params":`+string(p)+`}`), &req); err != nil {
+			t.Fatal(err)
+		}
+		if r := e.Handle(context.Background(), req); !r.OK {
+			t.Fatal("valid worker revoke denied", r)
+		}
+	}
+}

package/dist/templates/_executor/cmd/lifecycle/main.go

@@ -0,0 +1,42 @@
+// This helper runs as the package account, separately from the root executor.
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+
+	"synopkgland/executor/internal/lifecycle"
+)
+
+func main() {
+	if err := run(os.Args[1:]); err != nil {
+		fmt.Fprintln(os.Stderr, "executor lifecycle:", err)
+		os.Exit(1)
+	}
+}
+func run(args []string) error {
+	if len(args) == 0 {
+		return errors.New("start, stop or purge required")
+	}
+	action := args[0]
+	fs := flag.NewFlagSet("lifecycle", flag.ContinueOnError)
+	pkg := fs.String("package", "", "package account")
+	if err := fs.Parse(args[1:]); err != nil {
+		return err
+	}
+	if fs.NArg() != 0 {
+		return errors.New("unexpected arguments")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Second)
+	defer cancel()
+	data := os.Getenv("SYNOPKG_PKGVAR")
+	if data == "" {
+		data = filepath.Join("/var/packages", *pkg, "var")
+	}
+	return lifecycle.Run(ctx, lifecycle.Config{Package: *pkg, Data: data, Socket: filepath.Join("/run/synopkgland", *pkg, "executor.sock"), Log: func(s string) { fmt.Fprintln(os.Stderr, s) }}, action)
+}

package/dist/templates/_executor/cookie_review_test.go

@@ -0,0 +1,27 @@
+package main
+
+import (
+	"context"
+	"testing"
+)
+
+func TestReviewCookieControlRejectedBeforeDSM(t *testing.T) {
+	for _, cookie := range []string{"sess\tion", "sess\x7fion", "sess\x01ion"} {
+		e, _, _ := setup(t)
+		if _, code := e.verified(context.Background(), Auth{Cookie: cookie, SynoToken: "token"}); code == "" {
+			t.Errorf("cookie control character accepted: %q", cookie)
+		}
+	}
+}
+
+func TestExecutorCookieRejectsEveryASCIIControl(t *testing.T) {
+	for c := 0; c <= 127; c++ {
+		if c >= 32 && c != 127 {
+			continue
+		}
+		e, _, _ := setup(t)
+		if _, code := e.verified(context.Background(), Auth{Cookie: "sess" + string(rune(c)) + "ion", SynoToken: "token"}); code != "AUTH_DENIED" {
+			t.Errorf("accepted control %d", c)
+		}
+	}
+}

package/dist/templates/_executor/digest_review_test.go

@@ -0,0 +1,120 @@
+package main
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestReviewLargePackageHashDoesNotBlockShutdown(t *testing.T) {
+	dir, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	exe := filepath.Join(dir, "executor")
+	f, err := os.Create(exe)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = f.Truncate(1 << 40); err != nil {
+		f.Close()
+		t.Skip(err)
+	}
+	f.Close()
+	os.WriteFile(filepath.Join(dir, "policy.json"), []byte("policy"), 0600)
+	ctx, cancel := context.WithCancel(context.Background())
+	entered := make(chan struct{})
+	done := make(chan error, 1)
+	go func() {
+		done <- manageService(ctx, make(chan string), func() (func(), error) { return func() {}, nil }, func(ctx context.Context) bool {
+			close(entered)
+			return samePackagePins(ctx, dir, strings.Repeat("a", 64), strings.Repeat("b", 64))
+		}, func() error { return nil }, func(string) {})
+	}()
+	<-entered
+	time.Sleep(20 * time.Millisecond)
+	cancel()
+	blocked := false
+	select {
+	case <-done:
+	case <-time.After(50 * time.Millisecond):
+		blocked = true
+	}
+	os.Truncate(exe, 0)
+	if blocked {
+		<-done
+		t.Fatal("canceled monitor remains blocked hashing package-controlled file")
+	}
+}
+
+func TestDigestBoundsAndCancellation(t *testing.T) {
+	dir := realTestPath(t, t.TempDir())
+	for _, tc := range []struct {
+		name  string
+		limit int64
+	}{{"executor", maxExecutorBytes}, {"policy.json", maxPolicyBytes}} {
+		path := filepath.Join(dir, tc.name)
+		f, err := os.Create(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err = f.Truncate(tc.limit + 1); err != nil {
+			t.Fatal(err)
+		}
+		f.Close()
+		if _, err = digestFile(context.Background(), path, tc.limit); err == nil {
+			t.Fatal("oversize file accepted")
+		}
+		os.WriteFile(path, []byte("valid"), 0600)
+		ctx, cancel := context.WithCancel(context.Background())
+		cancel()
+		if _, err = digestFile(ctx, path, tc.limit); err != context.Canceled {
+			t.Fatal("ignored cancellation", err)
+		}
+	}
+	if _, err := digestFile(context.Background(), dir, maxExecutorBytes); err == nil {
+		t.Fatal("directory accepted")
+	}
+	os.Symlink(filepath.Join(dir, "executor"), filepath.Join(dir, "link"))
+	if _, err := digestFile(context.Background(), filepath.Join(dir, "link"), maxExecutorBytes); err == nil {
+		t.Fatal("symlink accepted")
+	}
+}
+
+func TestLifecycleCancelsPendingPinCheck(t *testing.T) {
+	for _, action := range []string{"stop", "purge", "shutdown"} {
+		t.Run(action, func(t *testing.T) {
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+			entered, canceled := make(chan struct{}), make(chan struct{})
+			actions := make(chan string)
+			done := make(chan error, 1)
+			go func() {
+				done <- manageService(ctx, actions, func() (func(), error) { t.Error("opened during canceled check"); return func() {}, nil }, func(ctx context.Context) bool { close(entered); <-ctx.Done(); close(canceled); return false }, func() error { return nil }, func(string) {})
+			}()
+			<-entered
+			if action == "shutdown" {
+				cancel()
+			} else {
+				actions <- action
+			}
+			select {
+			case <-canceled:
+			case <-time.After(time.Second):
+				t.Fatal("pin check not canceled")
+			}
+			cancel()
+			select {
+			case err := <-done:
+				if err != nil {
+					t.Fatal(err)
+				}
+			case <-time.After(time.Second):
+				t.Fatal("monitor stuck")
+			}
+		})
+	}
+}

package/dist/templates/_executor/directories.go

@@ -0,0 +1,40 @@
+package main
+
+import (
+	"errors"
+	"os"
+	"syscall"
+)
+
+func directoryMatches(info os.FileInfo, mode os.FileMode, uid, gid int) bool {
+	st, ok := info.Sys().(*syscall.Stat_t)
+	return ok && info.IsDir() && info.Mode().Perm() == mode && int(st.Uid) == uid && int(st.Gid) == gid
+}
+
+// Only repair permissions on a directory this invocation created. mkdir's
+// requested mode is reduced by the inherited boot-task umask (normally 0077).
+func createDirectory(path string, mode os.FileMode, uid, gid int) (os.FileInfo, error) {
+	if err := os.Mkdir(path, mode); err != nil {
+		return nil, err
+	}
+	fd, err := syscall.Open(path, syscall.O_RDONLY|syscall.O_DIRECTORY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0)
+	if err != nil {
+		return nil, err
+	}
+	f := os.NewFile(uintptr(fd), path)
+	defer f.Close()
+	if err = f.Chown(uid, gid); err != nil {
+		return nil, err
+	}
+	if err = f.Chmod(mode); err != nil {
+		return nil, err
+	}
+	info, err := f.Stat()
+	if err != nil {
+		return nil, err
+	}
+	if !directoryMatches(info, mode, uid, gid) {
+		return nil, errors.New("created directory permissions")
+	}
+	return info, nil
+}