@synopackageland/cli 0.5.0 → 0.6.0

package/templates/_executor/executor_test.go

@@ -0,0 +1,284 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+type fakeDSM struct {
+	user                     Subject
+	accountErr, privilegeErr error
+	apiCalls                 int
+	root                     string
+}
+
+func (f *fakeDSM) Verify(context.Context, string, string) (string, error) {
+	return f.user.Username, nil
+}
+func (f *fakeDSM) Account(context.Context, string) (Subject, error)           { return f.user, f.accountErr }
+func (f *fakeDSM) Allow(context.Context, Subject, string) error               { return f.privilegeErr }
+func (f *fakeDSM) ScopeRoot(context.Context, Subject, string) (string, error) { return f.root, nil }
+func (f *fakeDSM) API(context.Context, string, string, map[string]any) (json.RawMessage, error) {
+	f.apiCalls++
+	return json.RawMessage(`{"allowed":true}`), nil
+}
+
+type fakeWriter struct{ calls int }
+
+func (f *fakeWriter) Write(context.Context, Subject, string, string, string, string) error {
+	f.calls++
+	return nil
+}
+func setup(t *testing.T) (*Executor, *fakeDSM, *fakeWriter) {
+	t.Helper()
+	root, _ := filepath.EvalSymlinks(t.TempDir())
+	f := &fakeDSM{user: Subject{Username: "alice", UID: 1200, GID: 100, Groups: []int{100}, Home: root, Expired: "normal"}, root: root}
+	w := &fakeWriter{}
+	e := &Executor{Policy: Policy{Version: 1, Package: "p2probe", App: "app", Scope: "home", Operations: allOps}, DSM: f, Writer: w, Store: &Store{Dir: t.TempDir()}, Now: func() time.Time { return time.Unix(1000, 0) }}
+	return e, f, w
+}
+func request(e *Executor, op string, params any) Response {
+	b, _ := json.Marshal(params)
+	return e.Handle(context.Background(), Request{Version: 1, Op: op, Auth: Auth{Cookie: "session", SynoToken: "token"}, Params: b})
+}
+func create(t *testing.T, e *Executor) string {
+	t.Helper()
+	r := request(e, "delegate.create", map[string]any{"job_id": "job1", "ops": []string{"files.write", "files.list"}, "scope": "home", "path": "/home", "ttl_seconds": 60})
+	if !r.OK {
+		t.Fatalf("create: %+v", r)
+	}
+	b, _ := json.Marshal(r.Result)
+	var d Delegation
+	json.Unmarshal(b, &d)
+	return d.ID
+}
+func TestRejections(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		mutate func(*Executor, *fakeDSM, *fakeWriter, string)
+		params map[string]any
+		code   string
+	}{
+		{"missing account", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.accountErr = errors.New("missing") }, nil, "INELIGIBLE"},
+		{"disabled", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.Expired = "now" }, nil, "INELIGIBLE"},
+		{"unknown disabled state", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.Expired = "" }, nil, "INELIGIBLE"},
+		{"admin runner", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.Admin = true }, nil, "INELIGIBLE"},
+		{"system runner", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.UID = 1 }, nil, "INELIGIBLE"},
+		{"uid reuse", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.UID++ }, nil, "INELIGIBLE"},
+		{"app deny", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.privilegeErr = errors.New("deny") }, nil, "APP_DENIED"},
+		{"expired", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) {
+			e.Now = func() time.Time { return time.Unix(1060, 0) }
+		}, nil, "DELEGATION_DENIED"},
+		{"revoked", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) {
+			d, _ := e.Store.Get(id)
+			d.Revoked = true
+			e.Store.Put(d)
+		}, nil, "DELEGATION_DENIED"},
+		{"job", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) {}, map[string]any{"job_id": "job2"}, "DELEGATION_DENIED"},
+		{"scope", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) {}, map[string]any{"dest_dir": "/etc"}, "SCOPE_DENIED"},
+		{"dotdot", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) {}, map[string]any{"dest_dir": "/home/../home"}, "INVALID_REQUEST"},
+		{"name", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) {}, map[string]any{"name": "../oops"}, "INVALID_REQUEST"},
+		{"outside staging", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) {}, map[string]any{"staging": "../secret"}, "INVALID_REQUEST"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			e, f, w := setup(t)
+			id := create(t, e)
+			tc.mutate(e, f, w, id)
+			p := map[string]any{"delegation_id": id, "job_id": "job1", "staging": "a", "dest_dir": "/home", "name": "new"}
+			for k, v := range tc.params {
+				p[k] = v
+			}
+			r := request(e, "files.write", p)
+			if r.OK || r.Code != tc.code || w.calls != 0 {
+				t.Fatalf("%+v calls=%d", r, w.calls)
+			}
+		})
+	}
+}
+func TestUnknownAndPolicy(t *testing.T) {
+	e, _, _ := setup(t)
+	if r := request(e, "shell", nil); r.Code != "UNKNOWN_OP" {
+		t.Fatal(r)
+	}
+	e.Policy.Operations = []string{"status"}
+	if r := request(e, "delegate.create", nil); r.Code != "POLICY_DENIED" {
+		t.Fatal(r)
+	}
+}
+func TestSpoofedUsername(t *testing.T) {
+	e, _, _ := setup(t)
+	r := request(e, "delegate.create", map[string]any{"username": "bob", "job_id": "j", "ops": []string{"files.list"}, "scope": "home", "path": "/home", "ttl_seconds": 10})
+	if r.OK || r.Code != "INVALID_REQUEST" {
+		t.Fatal(r)
+	}
+	id := create(t, e)
+	d, _ := e.Store.Get(id)
+	if d.Subject.Username != "alice" {
+		t.Fatal(d)
+	}
+}
+func TestScopeSymlink(t *testing.T) {
+	e, f, _ := setup(t)
+	id := create(t, e)
+	os.Symlink(t.TempDir(), filepath.Join(f.root, "escape"))
+	r := request(e, "files.list", map[string]any{"delegation_id": id, "job_id": "job1", "path": "/home/escape"})
+	if r.Code != "SCOPE_DENIED" || f.apiCalls != 1 {
+		t.Fatal(r, f.apiCalls)
+	}
+}
+func TestOperationDelegation(t *testing.T) {
+	e, _, _ := setup(t)
+	id := create(t, e)
+	r := request(e, "files.info", map[string]any{"delegation_id": id, "job_id": "job1", "path": "/home"})
+	if r.Code != "DELEGATION_DENIED" {
+		t.Fatal(r)
+	}
+}
+func TestListAndRevokeOwnership(t *testing.T) {
+	e, f, _ := setup(t)
+	id := create(t, e)
+	f.user.Username = "bob"
+	r := request(e, "delegate.list", map[string]any{})
+	b, _ := json.Marshal(r.Result)
+	if strings.Contains(string(b), id) {
+		t.Fatal(r)
+	}
+	r = request(e, "delegate.revoke", map[string]any{"delegation_id": id})
+	if r.Code != "DELEGATION_DENIED" {
+		t.Fatal(r)
+	}
+	r = e.Handle(context.Background(), Request{Version: 1, Op: "delegate.revoke", Params: json.RawMessage(`{"delegation_id":"` + id + `","job_id":"job1"}`)})
+	if !r.OK {
+		t.Fatal(r)
+	}
+}
+func TestProtocol(t *testing.T) {
+	for _, tc := range []struct{ name, raw, code string }{{"oversize", strings.Repeat("x", 65537) + "\n", "REQUEST_TOO_LARGE"}, {"unknown field", `{"v":1,"op":"status","username":"admin"}` + "\n", "INVALID_REQUEST"}, {"duplicate", `{"v":1,"v":1,"op":"status"}` + "\n", "INVALID_REQUEST"}, {"utf8", string([]byte{255}) + "\n", "INVALID_REQUEST"}, {"version", `{"v":2,"op":"status"}` + "\n", "INVALID_REQUEST"}} {
+		t.Run(tc.name, func(t *testing.T) {
+			e, _, _ := setup(t)
+			a, b := net.Pipe()
+			go func() {
+				defer a.Close()
+				e.Connection(context.Background(), a, 100, func(net.Conn) (int, error) { return 100, nil })
+			}()
+			defer b.Close()
+			go b.Write([]byte(tc.raw))
+			var r Response
+			if err := json.NewDecoder(b).Decode(&r); err != nil || r.Code != tc.code {
+				t.Fatalf("%+v %v", r, err)
+			}
+		})
+	}
+}
+func TestWrongPeer(t *testing.T) {
+	e, _, _ := setup(t)
+	a, b := net.Pipe()
+	go func() {
+		defer a.Close()
+		e.Connection(context.Background(), a, 100, func(net.Conn) (int, error) { return 101, nil })
+	}()
+	defer b.Close()
+	var r Response
+	if json.NewDecoder(b).Decode(&r) == nil {
+		t.Fatal("wrong uid got response")
+	}
+}
+func TestStorePersistence(t *testing.T) {
+	e, _, _ := setup(t)
+	id := create(t, e)
+	d, err := (&Store{Dir: e.Store.Dir}).Get(id)
+	if err != nil || d.Subject.UID != 1200 {
+		t.Fatal(d, err)
+	}
+	info, _ := os.Stat(filepath.Join(e.Store.Dir, id+".json"))
+	if info.Mode().Perm() != 0600 {
+		t.Fatal(info.Mode())
+	}
+	if _, err = e.Store.Get("../x"); err == nil {
+		t.Fatal("traversal")
+	}
+}
+
+func TestFileStationPrivilegeRequiredSeparately(t *testing.T) {
+	e, f, _ := setup(t)
+	e.DSM = &selectivePrivilege{fakeDSM: f}
+	if out := request(e, "delegate.create", map[string]any{"job_id": "j", "ops": []string{"files.list"}, "scope": "home", "path": "/home", "ttl_seconds": 10}); out.Code != "APP_DENIED" {
+		t.Fatal(out)
+	}
+}
+
+type selectivePrivilege struct{ *fakeDSM }
+
+func (f *selectivePrivilege) Allow(_ context.Context, _ Subject, app string) error {
+	if app == "SYNO.SDS.App.FileStation3.Instance" {
+		return errors.New("deny File Station")
+	}
+	return nil
+}
+func TestSharedScope(t *testing.T) {
+	e, _, _ := setup(t)
+	e.Policy.Scope = "shared:p2probe-share"
+	out := request(e, "delegate.create", map[string]any{"job_id": "j", "ops": []string{"files.list"}, "scope": "shared:p2probe-share", "path": "/p2probe-share", "ttl_seconds": 10})
+	if !out.OK {
+		t.Fatal(out)
+	}
+}
+func TestPolicyValidation(t *testing.T) {
+	base := Policy{Version: 1, Package: "p2probe", App: "app", Scope: "home", Operations: allOps}
+	if validatePolicy(base, "p2probe") != nil {
+		t.Fatal("valid policy")
+	}
+	for _, mutate := range []func(*Policy){func(p *Policy) { p.Package = "another" }, func(p *Policy) { p.Version = 2 }, func(p *Policy) { p.Operations = []string{"shell"} }, func(p *Policy) { p.Operations = []string{"status", "status"} }, func(p *Policy) { p.Scope = "../../etc" }, func(p *Policy) { p.Root = map[string]string{"a": "bad"} }} {
+		p := base
+		mutate(&p)
+		if validatePolicy(p, "p2probe") == nil {
+			t.Fatal("invalid policy accepted")
+		}
+	}
+}
+func TestFilenameAndTTL(t *testing.T) {
+	for _, n := range []string{"", "..", "a..b", "a/b", "a\x00b", "a\tb", "a\nb"} {
+		if validName(n) {
+			t.Fatal(n)
+		}
+	}
+	e, _, _ := setup(t)
+	for _, ttl := range []int{0, -1, 2592001} {
+		out := request(e, "delegate.create", map[string]any{"job_id": "j", "ops": []string{"files.list"}, "scope": "home", "path": "/home", "ttl_seconds": ttl})
+		if out.Code != "INVALID_REQUEST" {
+			t.Fatal(out)
+		}
+	}
+}
+func TestStoreRejectSymlinkAndMode(t *testing.T) {
+	e, _, _ := setup(t)
+	id := create(t, e)
+	p := filepath.Join(e.Store.Dir, id+".json")
+	os.Chmod(p, 0644)
+	if _, err := e.Store.Get(id); err == nil {
+		t.Fatal("mode")
+	}
+	os.Remove(p)
+	os.Symlink(filepath.Join(t.TempDir(), "secret"), p)
+	if _, err := e.Store.Get(id); err == nil {
+		t.Fatal("symlink")
+	}
+}
+
+func TestCallerRequiresBothSessionValuesWithoutCredentialLeak(t *testing.T) {
+	e, _, _ := setup(t)
+	for _, auth := range []Auth{{Cookie: "secret-cookie"}, {SynoToken: "secret-token"}, {Cookie: "secret-cookie", SynoToken: "secret\r\nInjected: value"}, {Cookie: "secret-cookie", SynoToken: strings.Repeat("x", 4097)}} {
+		out := e.Handle(context.Background(), Request{Version: 1, Op: "delegate.list", Auth: auth, Params: json.RawMessage(`{}`)})
+		b, _ := json.Marshal(out)
+		if out.Code != "AUTH_DENIED" || strings.Contains(string(b), "secret") {
+			t.Fatal("invalid credentials not safely refused")
+		}
+	}
+}

package/templates/_executor/go.mod

@@ -0,0 +1,3 @@
+module synopkgland/executor
+
+go 1.23

package/templates/_executor/identity.go

@@ -0,0 +1,48 @@
+package main
+
+import (
+	"errors"
+	"fmt"
+	"sort"
+)
+
+// Injectable syscall surface: tests verify the exact ordering and every error.
+type identitySwitch interface {
+	Setgroups([]int) error
+	Setresgid(int, int, int) error
+	Setresuid(int, int, int) error
+	IDs() (int, int, int, int)
+	Groups() ([]int, error)
+}
+
+func dropIdentity(x identitySwitch, s Subject) error {
+	if s.UID < 1024 || s.GID < 0 || len(s.Groups) == 0 || s.Admin {
+		return errors.New("subject")
+	}
+	for _, g := range s.Groups {
+		if g < 0 {
+			return errors.New("groups")
+		}
+	}
+	if err := x.Setgroups(s.Groups); err != nil {
+		return err
+	}
+	if err := x.Setresgid(s.GID, s.GID, s.GID); err != nil {
+		return err
+	}
+	if err := x.Setresuid(s.UID, s.UID, s.UID); err != nil {
+		return err
+	}
+	uid, euid, gid, egid := x.IDs()
+	gs, err := x.Groups()
+	if err != nil {
+		return err
+	}
+	want := append([]int(nil), s.Groups...)
+	sort.Ints(want)
+	sort.Ints(gs)
+	if uid != s.UID || euid != s.UID || gid != s.GID || egid != s.GID || fmt.Sprint(gs) != fmt.Sprint(want) {
+		return errors.New("identity mismatch")
+	}
+	return nil
+}

package/templates/_executor/internal/lifecycle/lifecycle.go

@@ -0,0 +1,90 @@
+// Package-account lifecycle only writes a bounded control request and waits.
+package lifecycle
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"regexp"
+	"time"
+)
+
+type Config struct {
+	Package, Data, Socket string
+	Log                   func(string)
+}
+
+var packageName = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9]{1,63}$`)
+
+func absent(path string) (bool, error) {
+	_, err := os.Lstat(path)
+	if os.IsNotExist(err) {
+		return true, nil
+	}
+	return false, err
+}
+func Run(ctx context.Context, cfg Config, action string) error {
+	if !packageName.MatchString(cfg.Package) || (action != "start" && action != "stop" && action != "purge") {
+		return errors.New("invalid lifecycle request")
+	}
+	mailbox := filepath.Join(cfg.Data, "executor")
+	if err := os.MkdirAll(mailbox, 0700); err != nil {
+		return err
+	}
+	info, err := os.Lstat(mailbox)
+	if err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
+		return errors.New("unsafe control directory")
+	}
+	path := filepath.Join(mailbox, "control")
+	if info, err := os.Lstat(path); err == nil && !info.Mode().IsRegular() {
+		return errors.New("unsafe control file")
+	} else if err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	f, err := os.CreateTemp(mailbox, ".control-")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(f.Name())
+	if _, err = f.WriteString(action + "\n"); err != nil {
+		f.Close()
+		return err
+	}
+	if err = f.Sync(); err != nil {
+		f.Close()
+		return err
+	}
+	if err = f.Close(); err != nil {
+		return err
+	}
+	if err = os.Rename(f.Name(), path); err != nil {
+		return err
+	}
+	if action == "start" {
+		return nil
+	}
+	// Offline requests still persist: the pinned boot task consumes pending purge.
+	ticker := time.NewTicker(100 * time.Millisecond)
+	defer ticker.Stop()
+	for {
+		gone, err := absent(cfg.Socket)
+		if err != nil {
+			if cfg.Log != nil {
+				cfg.Log("executor socket status unavailable: request retained; lifecycle continues")
+			}
+			return nil
+		}
+		if gone {
+			return nil
+		}
+		select {
+		case <-ctx.Done():
+			if cfg.Log != nil {
+				cfg.Log("executor " + action + " timeout: request retained; uninstall may continue; purge mailbox is handled immediately, missing-package fallback requires 10 continuous minutes")
+			}
+			return nil
+		case <-ticker.C:
+		}
+	}
+}

package/templates/_executor/internal/lifecycle/lifecycle_test.go

@@ -0,0 +1,174 @@
+package lifecycle
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestRequestPersistsOfflineWithoutScheduler(t *testing.T) {
+	for _, action := range []string{"stop", "purge"} {
+		t.Run(action, func(t *testing.T) {
+			root := t.TempDir()
+			cfg := Config{Package: "TestApp", Data: root, Socket: filepath.Join(root, "executor.sock")}
+			if err := Run(context.Background(), cfg, action); err != nil {
+				t.Fatal(err)
+			}
+			path := filepath.Join(root, "executor", "control")
+			b, err := os.ReadFile(path)
+			if err != nil || string(b) != action+"\n" {
+				t.Fatal(string(b), err)
+			}
+			info, _ := os.Stat(path)
+			if info.Mode().Perm() != 0600 {
+				t.Fatal(info.Mode())
+			}
+		})
+	}
+}
+func TestRequestWaitsForSocketAndTimeoutDoesNotBlockUninstall(t *testing.T) {
+	for _, action := range []string{"stop", "purge"} {
+		for _, timeout := range []bool{false, true} {
+			t.Run(action+"-"+map[bool]string{false: "confirmed", true: "timeout"}[timeout], func(t *testing.T) {
+				root := t.TempDir()
+				socket := filepath.Join(root, "executor.sock")
+				os.WriteFile(socket, []byte{}, 0600)
+				warnings := []string{}
+				cfg := Config{Package: "TestApp", Data: root, Socket: socket, Log: func(s string) { warnings = append(warnings, s) }}
+				limit := 500 * time.Millisecond
+				if timeout {
+					limit = 50 * time.Millisecond
+				}
+				ctx, cancel := context.WithTimeout(context.Background(), limit)
+				defer cancel()
+				done := make(chan struct{})
+				if !timeout {
+					go func() {
+						defer close(done)
+						for {
+							if _, err := os.Stat(filepath.Join(root, "executor", "control")); err == nil {
+								os.Remove(socket)
+								return
+							}
+							select {
+							case <-ctx.Done():
+								return
+							case <-time.After(time.Millisecond):
+							}
+						}
+					}()
+				} else {
+					close(done)
+				}
+				if err := Run(ctx, cfg, action); err != nil {
+					t.Fatal("uninstall was blocked:", err)
+				}
+				<-done
+				if !timeout && len(warnings) != 0 {
+					t.Fatal("confirmation timed out", warnings)
+				}
+				if timeout && (len(warnings) != 1 || !strings.Contains(warnings[0], "timeout")) {
+					t.Fatal("missing warning", warnings)
+				}
+				if _, err := os.Stat(filepath.Join(root, "executor", "control")); err != nil {
+					t.Fatal("pending purge lost", err)
+				}
+			})
+		}
+	}
+}
+func TestRequestRejectsInvalidActionAndSymlink(t *testing.T) {
+	root := t.TempDir()
+	cfg := Config{Package: "TestApp", Data: root, Socket: filepath.Join(root, "socket")}
+	if Run(context.Background(), cfg, "resume") == nil {
+		t.Fatal("invalid action accepted")
+	}
+	os.Mkdir(filepath.Join(root, "executor"), 0700)
+	outside := filepath.Join(root, "outside")
+	os.WriteFile(outside, []byte("safe"), 0600)
+	os.Symlink(outside, filepath.Join(root, "executor", "control"))
+	if Run(context.Background(), cfg, "purge") == nil {
+		t.Fatal("symlink accepted")
+	}
+	b, _ := os.ReadFile(outside)
+	if string(b) != "safe" {
+		t.Fatal("outside changed")
+	}
+}
+
+func TestInaccessibleSocketDoesNotBlockStopOrUninstall(t *testing.T) {
+	// ENOTDIR is deterministic even under root, unlike chmod-based EACCES.
+	// Both are status inspection failures, not control-file write failures.
+	for _, action := range []string{"stop", "purge"} {
+		t.Run(action, func(t *testing.T) {
+			root := t.TempDir()
+			blocked := filepath.Join(root, "blocked")
+			os.WriteFile(blocked, []byte{}, 0600)
+			logged := false
+			cfg := Config{Package: "TestApp", Data: root, Socket: filepath.Join(blocked, "executor.sock"), Log: func(string) { logged = true }}
+			if err := Run(context.Background(), cfg, action); err != nil {
+				t.Fatal("socket inspection blocked lifecycle", err)
+			}
+			if !logged {
+				t.Fatal("missing inaccessible socket warning")
+			}
+			b, err := os.ReadFile(filepath.Join(root, "executor", "control"))
+			if err != nil || string(b) != action+"\n" {
+				t.Fatal(string(b), err)
+			}
+		})
+	}
+}
+
+func TestUnreadableSocketDirectoryStillPersistsStopAndPurge(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("EACCES requires an unprivileged process; ENOTDIR regression covers root")
+	}
+	for _, action := range []string{"stop", "purge"} {
+		t.Run(action, func(t *testing.T) {
+			root := t.TempDir()
+			dir := filepath.Join(root, "socket-dir")
+			os.Mkdir(dir, 0700)
+			os.WriteFile(filepath.Join(dir, "executor.sock"), nil, 0600)
+			os.Chmod(dir, 0)
+			defer os.Chmod(dir, 0700)
+			logged := false
+			cfg := Config{Package: "TestApp", Data: root, Socket: filepath.Join(dir, "executor.sock"), Log: func(string) { logged = true }}
+			if _, err := os.Lstat(cfg.Socket); !os.IsPermission(err) {
+				t.Fatal("fixture did not deny inspection", err)
+			}
+			if err := Run(context.Background(), cfg, action); err != nil {
+				t.Fatal("permission denial blocked lifecycle", err)
+			}
+			if !logged {
+				t.Fatal("missing warning")
+			}
+			b, err := os.ReadFile(filepath.Join(root, "executor", "control"))
+			if err != nil || string(b) != action+"\n" {
+				t.Fatal(string(b), err)
+			}
+		})
+	}
+}
+
+func TestStartWritesResumeWithoutWaitingForSocket(t *testing.T) {
+	root := t.TempDir()
+	socket := filepath.Join(root, "socket")
+	os.WriteFile(socket, []byte("still paused"), 0600)
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	started := time.Now()
+	if err := Run(ctx, Config{Package: "TestApp", Data: root, Socket: socket}, "start"); err != nil {
+		t.Fatal(err)
+	}
+	if time.Since(started) > 100*time.Millisecond {
+		t.Fatal("start waited for approval/socket")
+	}
+	b, err := os.ReadFile(filepath.Join(root, "executor/control"))
+	if err != nil || string(b) != "start\n" {
+		t.Fatal("missing resume request")
+	}
+}

package/templates/_executor/internal/taskscript/boot.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+# synopkgland executor boot
+set -eu
+umask 77
+export PATH=/usr/bin:/bin
+p=@PACKAGE@
+q=/var/packages/$p
+s=$q/target/executor
+r=/usr/local/etc/synopkgland/$p
+d=$r/runtime
+v(){ echo "@EXECUTOR_DIGEST@  $1executor
+@POLICY_DIGEST@  $1policy.json"|sha256sum -c - >/dev/null || { logger digest;exit 1;};}
+a=purge
+if [ -d $q ];then
+a=stop
+[ "$(cat "$q/var/executor/control" 2>/dev/null)" != purge ] || { a=purge;[ -e $d ] || [ -L $d ] || { logger purged;exit 0;};}
+else [ -d $r ] || exit 0;fi
+[ $a = stop ] || s=$d
+v $s/
+mkdir -p -m 700 $d
+[ "$(find $d -maxdepth 0 -uid 0 -type d -perm 700)" = $d ]
+cd $d
+cp $s/executor .executor
+cp $s/policy.json .policy.json
+v .
+chmod 700 .executor
+./.executor control $a --package $p
+[ $a = stop ] || exit 0
+for f in executor policy.json;do mv .$f $f;done
+[ -e $s/../root ] && cp -R $s/../root .
+./executor control start --package $p

package/templates/_executor/internal/taskscript/cmd/main.go

@@ -0,0 +1,19 @@
+// Canonical renderer used to check CLI/executor byte equivalence locally.
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"synopkgland/executor/internal/taskscript"
+)
+
+func main() {
+	if len(os.Args) != 4 {
+		os.Exit(2)
+	}
+	tasks, err := taskscript.Generate(os.Args[1], os.Args[2], os.Args[3])
+	if err != nil {
+		os.Exit(1)
+	}
+	json.NewEncoder(os.Stdout).Encode(tasks)
+}

package/templates/_executor/internal/taskscript/control.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+# synopkgland executor control
+set -eu
+umask 77
+export PATH=/usr/bin:/bin
+p=@PACKAGE@
+q=/var/packages/$p
+s=$q/target/executor
+r=/usr/local/etc/synopkgland/$p
+d=$r/runtime
+v(){ { echo @EXECUTOR_DIGEST@"  $1/$2executor"; echo @POLICY_DIGEST@"  $1/$2policy.json"; }|sha256sum -c - >/dev/null || { logger digest;exit 1;};}
+v "$s" ''
+mkdir -p -m 700 "$d"
+[ "$(find "$d" -maxdepth 0 -uid 0 -type d -perm 700)" = "$d" ]
+a=$(cat /var/packages/$p/var/executor/control)
+case "$a" in start|stop|purge) ;; *) exit 1;; esac
+if [ "$a" = purge ]; then
+cp "$s/executor" "$d/.executor"
+cp "$s/policy.json" "$d/.policy.json"
+v "$d" .
+chmod 700 "$d/.executor"
+"$d/.executor" control purge --package "$p"
+else
+v "$d" ''
+"$d/executor" control $a --package $p
+fi