@synopackageland/cli 0.5.3 → 0.6.0

package/dist/templates/_executor/testdata/evidence/live.jsonl

@@ -0,0 +1,23 @@
+{"scenario": "status", "response": {"ok": true, "result": {"executor_digest": "4b0ae64de9e55f5c09de107ee5158791d114c0a31ddcb890fd848ee8dd9997fc", "policy_digest": "ccd9a4932bedd460f7b4f4d54d64449241f510721c19daa9caa426a12415fd6c", "ready": true, "version": "1"}}}
+{"scenario": "wrong peer", "response": {"closed": true}}
+{"scenario": "delegate.create /home", "response": {"ok": true, "result": {"delegation_id": "2758bd7d59f186c0e8cf3b09c6f347020616e42ae8286032e0bac5732e526393", "expires_at": "2026-10-08T01:33:23.604403596Z", "subject": {"uid": 1231, "username": "p2probe1"}}}}
+{"scenario": "files.write own home", "response": {"ok": true, "result": {"path": "/home/p2probe-output"}}}
+{"scenario": "owner", "uid": 1231, "gid": 100, "mode": "0o711", "content": "P2 executor content\n"}
+{"scenario": "ACL readback", "acl": "ACL version: 1 \nArchive: is_inherit,is_support_ACL \nOwner: [p2probe1(user)] \n--------------------- \n\t [0] user:p2probe1:allow:rwxpdDaARWcCo:---- (level:1)\n\t [1] group:administrators:allow:rwxpdDaARWc--:---- (level:2)\n\t [3] user:p2probe1:allow:rwxpdDaARWcCo:---- (level:2)\n\t [4] everyone::allow:--x----------:---- (level:2)", "note": "Unrelated inherited ACL rows omitted; parent ACL was not changed."}
+{"scenario": "no overwrite", "response": {"ok": false, "code": "WRITE_FAILED", "message": "write failed"}}
+{"scenario": "other home", "response": {"ok": false, "code": "SCOPE_DENIED", "message": "scope denied"}}
+{"scenario": "symlink escape", "response": {"ok": false, "code": "SCOPE_DENIED", "message": "scope denied"}}
+{"scenario": "cross job", "response": {"ok": false, "code": "DELEGATION_DENIED", "message": "delegation denied"}}
+{"scenario": "admin runner", "response": {"ok": false, "code": "INELIGIBLE", "message": "ineligible"}}
+{"scenario": "root.run admin", "response": {"ok": true, "result": {"output": "0\n"}}}
+{"scenario": "root.run regular", "response": {"ok": false, "code": "ADMIN_REQUIRED", "message": "admin required"}}
+{"scenario": "files.list", "response": {"ok": true, "result": {"files": [{"isdir": false, "name": "p2probe-output", "path": "/home/p2probe-output"}], "offset": 0, "total": 1}}}
+{"scenario": "files.info", "response": {"ok": true, "result": {"files": [{"isdir": false, "name": "p2probe-output", "path": "/home/p2probe-output"}]}}}
+{"scenario": "files.createFolder", "response": {"ok": true, "result": {"folders": [{"isdir": true, "name": "p2probe-folder", "path": "/home/p2probe-folder"}]}}}
+{"scenario": "files.checkPermission", "response": {"ok": true, "result": {"blSkip": false}}}
+{"scenario": "disabled runner", "response": {"ok": false, "code": "INELIGIBLE", "message": "ineligible"}}
+{"scenario": "AppPriv deny", "response": {"ok": false, "code": "APP_DENIED", "message": "app denied"}}
+{"scenario": "revoke", "response": {"ok": true, "result": {"revoked": true}}}
+{"scenario": "revoked", "response": {"ok": false, "code": "DELEGATION_DENIED", "message": "delegation denied"}}
+{"scenario": "delegate.create /home", "response": {"ok": true, "result": {"delegation_id": "fd1401cfacf74a51571c9991007b74f3b00d1965d0c024555e4950b0c2764885", "expires_at": "2026-10-08T01:33:50.727843683Z", "subject": {"uid": 1233, "username": "p2probe2"}}}}
+{"scenario": "deleted runner", "response": {"ok": false, "code": "INELIGIBLE", "message": "ineligible"}}

package/dist/templates/_executor/testdata/evidence/storage.json

@@ -0,0 +1,90 @@
+{
+  "host": "vt-nas.syno",
+  "dsm": "7.4-90069",
+  "arch": "x86_64",
+  "measurements": [
+    {
+      "path": "/usr/syno/etc/packages",
+      "owner": "root",
+      "group": "root",
+      "mode": "0o755",
+      "resolved": "/usr/syno/etc/packages",
+      "symlink": false
+    },
+    {
+      "path": "/usr/syno/etc/packages/FileStation",
+      "owner": "FileStation",
+      "group": "FileStation",
+      "mode": "0o755",
+      "resolved": "/usr/syno/etc/packages/FileStation",
+      "symlink": false
+    },
+    {
+      "path": "/var/packages/FileStation/etc",
+      "owner": "root",
+      "group": "root",
+      "mode": "0o777",
+      "resolved": "/usr/syno/etc/packages/FileStation",
+      "symlink": true
+    },
+    {
+      "path": "/usr/local",
+      "owner": "root",
+      "group": "root",
+      "mode": "0o755",
+      "resolved": "/usr/local",
+      "symlink": false
+    },
+    {
+      "path": "/usr/local/etc",
+      "owner": "root",
+      "group": "root",
+      "mode": "0o755",
+      "resolved": "/usr/local/etc",
+      "symlink": false
+    },
+    {
+      "path": "/usr/local/etc/synopkgland/p2probepkg",
+      "owner": "root",
+      "group": "root",
+      "mode": "0o700",
+      "resolved": "/usr/local/etc/synopkgland/p2probepkg",
+      "symlink": false
+    },
+    {
+      "path": "/usr/local/etc/synopkgland/p2probepkg/runtime",
+      "owner": "root",
+      "group": "root",
+      "mode": "0o700",
+      "resolved": "/usr/local/etc/synopkgland/p2probepkg/runtime",
+      "symlink": false
+    },
+    {
+      "path": "/usr/local/etc/synopkgland/p2probepkg/delegations",
+      "owner": "root",
+      "group": "root",
+      "mode": "0o700",
+      "resolved": "/usr/local/etc/synopkgland/p2probepkg/delegations",
+      "symlink": false
+    },
+    {
+      "path": "/run/synopkgland/p2probepkg",
+      "owner": "root",
+      "group": "users",
+      "mode": "0o750",
+      "resolved": "/run/synopkgland/p2probepkg",
+      "symlink": false
+    },
+    {
+      "path": "/run/synopkgland/p2probepkg/executor.sock",
+      "owner": "root",
+      "group": "users",
+      "mode": "0o660",
+      "resolved": "/run/synopkgland/p2probepkg/executor.sock",
+      "symlink": false
+    }
+  ],
+  "reboot_retention": "unverified in this task",
+  "package_upgrade_retention": "unverified in this task",
+  "dsm_update_retention": "unknown"
+}

package/dist/templates/_executor/testdata/evidence/validation.json

@@ -0,0 +1,55 @@
+{
+  "baseline": "e13b651",
+  "host": "darwin/arm64 Go 1.26.0",
+  "linux_host": "vt-nas.syno DSM 7.4-90069 x86_64",
+  "executor_tests": {
+    "host_cases_passed": 52,
+    "host_top_level_tests": 21,
+    "linux_cases_passed": 61,
+    "linux_top_level_tests": 30
+  },
+  "gates": {
+    "native-go": {
+      "result": "PASS",
+      "checks": [
+        "executor race/vet/gofmt",
+        "Linux amd64/arm64 vet, static build, test compilation",
+        "native-go backend race/vet/gofmt"
+      ]
+    },
+    "daemon-gateway": {
+      "result": "PASS"
+    },
+    "npm": {
+      "result": "PASS",
+      "cli": {
+        "tests": 795,
+        "pass": 793,
+        "skip": 2,
+        "fail": 0
+      },
+      "package_source": {
+        "tests": 64,
+        "pass": 64,
+        "fail": 0
+      },
+      "release_scripts": {
+        "tests": 6,
+        "pass": 6,
+        "fail": 0
+      },
+      "shell_scripts": "PASS"
+    },
+    "website": {
+      "result": "PASS",
+      "tests": 41,
+      "pass": 41,
+      "fail": 0,
+      "astro_errors": 0,
+      "astro_hints": 1
+    }
+  },
+  "final_live_executor_sha256": "bc6d66fb667abf19a2a15f45da3aa90fc84e26fceaf9198bf904b6f8daa1b960",
+  "live_policy_sha256": "ccd9a4932bedd460f7b4f4d54d64449241f510721c19daa9caa426a12415fd6c",
+  "spk": "Not built; CLI/SPK integration is outside this task ownership."
+}

package/dist/templates/_executor/testdata/live_probe.py

@@ -0,0 +1,98 @@
+#!/usr/bin/env python3
+"""Root-only disposable vt-nas probe. Password JSON is read from stdin, never logged.
+Requires pre-created p2probe{1,2,adm,pkg}, protected runtime, home-scoped policy.
+No tasks, installed packages or global DSM settings are changed.
+"""
+import json, os, pathlib, pwd, socket, subprocess, sys, urllib.parse, urllib.request
+
+creds = json.load(sys.stdin)
+BASE = pathlib.Path('/usr/local/etc/synopkgland/p2probepkg')
+SOCK = '/run/synopkgland/p2probepkg/executor.sock'
+STAGE = pathlib.Path('/var/packages/p2probepkg/var/executor-staging')
+sessions = {}
+
+def api(params):
+    data = urllib.parse.urlencode(params).encode()
+    with urllib.request.urlopen('http://127.0.0.1:5000/webapi/entry.cgi', data, timeout=15) as r:
+        return json.load(r)
+
+def login(name):
+    r = api({'api':'SYNO.API.Auth','method':'login','version':'7','account':name,'passwd':creds[name],'format':'sid','enable_syno_token':'yes'})
+    assert r.get('success'), ('login failed', name, r.get('error'))
+    sessions[name] = r['data']
+    return sessions[name]['sid']
+
+def run_api(api_name, method, **params):
+    args = ['/usr/syno/bin/synowebapi','--exec','api='+api_name,'method='+method,'version=1']
+    args += [k+'='+json.dumps(v) for k,v in params.items()]
+    r = subprocess.run(args, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)
+    return json.loads(r.stdout)
+
+def call(op, params=None, cookie=None, peer='p2probepkg'):
+    req = {'v':1,'op':op,'params':params or {}}
+    if cookie: req['auth'] = {'dsm_cookie':cookie,'dsm_synotoken':next((v['synotoken'] for v in sessions.values() if v['sid']==cookie),'')}
+    # Launch a disposable package-uid client, with no root client shortcut.
+    u = pwd.getpwnam(peer)
+    def identity():
+        os.setgroups(os.getgrouplist(peer,u.pw_gid));os.setgid(u.pw_gid);os.setuid(u.pw_uid)
+    script = 'import socket,sys;s=socket.socket(socket.AF_UNIX);s.settimeout(35);s.connect(sys.argv[1]);s.sendall(sys.stdin.buffer.read());print(s.recv(1048576).decode())'
+    r = subprocess.run(['/usr/bin/python3','-c',script,SOCK],input=(json.dumps(req)+'\n').encode(),stdout=subprocess.PIPE,stderr=subprocess.PIPE,preexec_fn=identity)
+    raw = r.stdout.decode().strip()
+    return json.loads(raw) if raw else {'closed':True}
+
+def check(label, response, code=None):
+    print(json.dumps({'scenario':label,'response':response}),flush=True)
+    assert response.get('ok') if code is None else response.get('code')==code, label
+
+def create(cookie, path='/home'):
+    r=call('delegate.create',{'job_id':'p2probejob','ops':['files.write','files.list','files.info','files.createFolder','files.checkPermission'],'scope':'home','path':path,'ttl_seconds':600},cookie)
+    check('delegate.create '+path,r)
+    return r['result']['delegation_id']
+
+try:
+    alice=login('p2probe1');bob=login('p2probe2');admin=login('p2probeadm')
+    check('status',call('status'))
+    denied=call('status',peer='p2probe2');print(json.dumps({'scenario':'wrong peer','response':denied}));assert denied.get('closed')
+    delegation=create(alice)
+    p={'delegation_id':delegation,'job_id':'p2probejob','staging':'p2probe-source','dest_dir':'/home','name':'p2probe-output'}
+    STAGE.joinpath('p2probe-source').write_text('P2 executor content\n')
+    os.chown(str(STAGE/'p2probe-source'),pwd.getpwnam('p2probepkg').pw_uid,pwd.getpwnam('p2probepkg').pw_gid)
+    check('files.write own home',call('files.write',p))
+    out=pathlib.Path('/var/services/homes/p2probe1/p2probe-output');st=out.stat();assert st.st_uid==pwd.getpwnam('p2probe1').pw_uid
+    print(json.dumps({'scenario':'owner','uid':st.st_uid,'gid':st.st_gid,'mode':oct(st.st_mode&0o777),'content':out.read_text()}))
+    acl=subprocess.run(['/usr/syno/bin/synoacltool','-get',str(out)],stdout=subprocess.PIPE,stderr=subprocess.STDOUT).stdout.decode()
+    print(json.dumps({'scenario':'ACL readback','acl':acl}))
+    assert 'inherited' in acl.lower() or 'level:1' in acl.lower() or 'level: 1' in acl.lower(), 'ACL did not inherit'
+    STAGE.joinpath('p2probe-source').write_text('must not overwrite')
+    os.chown(str(STAGE/'p2probe-source'),pwd.getpwnam('p2probepkg').pw_uid,pwd.getpwnam('p2probepkg').pw_gid)
+    check('no overwrite',call('files.write',p),'WRITE_FAILED');assert out.read_text()=='P2 executor content\n'
+    check('other home',call('files.write',dict(p,dest_dir='/homes/p2probe2')),'SCOPE_DENIED')
+    home=pathlib.Path('/var/services/homes/p2probe1');(home/'p2probe-escape').symlink_to('/var/services/homes/p2probe2',target_is_directory=True)
+    check('symlink escape',call('files.write',dict(p,dest_dir='/home/p2probe-escape')),'SCOPE_DENIED')
+    check('cross job',call('files.write',dict(p,job_id='other')),'DELEGATION_DENIED')
+    check('admin runner',call('delegate.create',{'job_id':'j','ops':['files.list'],'scope':'home','path':'/home','ttl_seconds':30},admin),'INELIGIBLE')
+    check('root.run admin',call('root.run',{'name':'whoami'},admin))
+    check('root.run regular',call('root.run',{'name':'whoami'},alice),'ADMIN_REQUIRED')
+    check('files.list',call('files.list',{'delegation_id':delegation,'job_id':'p2probejob','path':'/home'}))
+    check('files.info',call('files.info',{'delegation_id':delegation,'job_id':'p2probejob','path':'/home/p2probe-output'}))
+    check('files.createFolder',call('files.createFolder',{'delegation_id':delegation,'job_id':'p2probejob','path':'/home','name':'p2probe-folder'}))
+    check('files.checkPermission',call('files.checkPermission',{'delegation_id':delegation,'job_id':'p2probejob','path':'/home'}))
+    # Mutate only disposable identities/privileges, then restore and read back.
+    r=run_api('SYNO.Core.User','set',name='p2probe1',expired='now');assert r.get('success')
+    check('disabled runner',call('files.list',{'delegation_id':delegation,'job_id':'p2probejob','path':'/home'}),'INELIGIBLE')
+    assert run_api('SYNO.Core.User','set',name='p2probe1',expired='normal').get('success')
+    rules=[{'entity_type':'user','entity_name':'p2probe1','app_id':'SYNO.SDS.App.FileStation3.Instance','deny_ip':['0.0.0.0']}]
+    assert run_api('SYNO.Core.AppPriv.Rule','set',rules=rules).get('success')
+    check('AppPriv deny',call('files.list',{'delegation_id':delegation,'job_id':'p2probejob','path':'/home'}),'APP_DENIED')
+    assert run_api('SYNO.Core.AppPriv.Rule','delete',rules=[{'entity_type':'user','entity_name':'p2probe1','app_id':'SYNO.SDS.App.FileStation3.Instance'}]).get('success')
+    check('revoke',call('delegate.revoke',{'delegation_id':delegation,'job_id':'p2probejob'}))
+    check('revoked',call('files.list',{'delegation_id':delegation,'job_id':'p2probejob','path':'/home'}),'DELEGATION_DENIED')
+    # Deleted account with a root-only delegation: success-empty DSM data is insufficient.
+    d=create(bob)
+    subprocess.run(['/usr/syno/sbin/synouser','--del','p2probe2'],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
+    check('deleted runner',call('files.list',{'delegation_id':d,'job_id':'p2probejob','path':'/home'}),'INELIGIBLE')
+finally:
+    for session in sessions.values():
+        sid=session['sid']
+        try:api({'api':'SYNO.API.Auth','version':'7','method':'logout','_sid':sid})
+        except Exception:pass

package/dist/templates/_executor/upgrade_watch_test.go

@@ -0,0 +1,236 @@
+package main
+
+import (
+	"context"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"synopkgland/executor/internal/lifecycle"
+)
+
+func TestUpgradeGapPreservesRuntimeAndResumesOnlyApprovedPins(t *testing.T) {
+	for _, gap := range []string{"directory", "INFO"} {
+		for _, mode := range []string{"same pins", "new policy", "upgrade stop"} {
+			t.Run(gap+"/"+mode, func(t *testing.T) {
+				root := realTestPath(t, t.TempDir())
+				pkg := filepath.Join(root, "package")
+				target := filepath.Join(pkg, "target", "executor")
+				data := filepath.Join(root, "data")
+				state := filepath.Join(root, "protected")
+				sockDir := filepath.Join(root, "socket")
+				socket := filepath.Join(sockDir, "s")
+				for _, dir := range []string{target, filepath.Join(data, "executor"), filepath.Join(state, "runtime"), filepath.Join(state, "delegations"), sockDir} {
+					if err := os.MkdirAll(dir, 0700); err != nil {
+						t.Fatal(err)
+					}
+				}
+				write := func(path, text string) {
+					t.Helper()
+					if err := os.WriteFile(path, []byte(text), 0600); err != nil {
+						t.Fatal(err)
+					}
+				}
+				info := filepath.Join(pkg, "INFO")
+				write(info, "package=\"TestApp\"\n")
+				write(filepath.Join(target, "executor"), "approved executable")
+				write(filepath.Join(target, "policy.json"), "approved policy")
+				markers := []string{filepath.Join(state, "runtime", "tasks.json"), filepath.Join(state, "delegations", "grant")}
+				for _, marker := range markers {
+					write(marker, "retained")
+				}
+				ed, err := digestFile(context.Background(), filepath.Join(target, "executor"), maxExecutorBytes)
+				if err != nil {
+					t.Fatal(err)
+				}
+				pd, err := digestFile(context.Background(), filepath.Join(target, "policy.json"), maxPolicyBytes)
+				if err != nil {
+					t.Fatal(err)
+				}
+				control := filepath.Join(data, "executor", "control")
+				write(control, "start\n")
+				m := newLifecycleMonitor("TestApp", pkg, control, func(string) {})
+				ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+				defer cancel()
+				actions := make(chan string)
+				var opened, closed, purged atomic.Int32
+				approval := make(chan struct{}, 1)
+				done := make(chan error, 1)
+				finished := make(chan struct{})
+				go func() {
+					defer close(finished)
+					done <- manageService(ctx, actions, func() (func(), error) {
+						listener, err := net.Listen("unix", socket)
+						if err != nil {
+							return nil, err
+						}
+						opened.Add(1)
+						return func() { listener.Close(); closed.Add(1) }, nil
+					}, func(ctx context.Context) bool { return samePackagePins(ctx, target, ed, pd) }, func() error {
+						purged.Add(1)
+						return finishControl(state, filepath.Join(state, "runtime"), sockDir, true)
+					}, func(message string) {
+						if strings.Contains(message, "administrator approval") {
+							approval <- struct{}{}
+						}
+					})
+				}()
+				t.Cleanup(func() {
+					cancel()
+					select {
+					case <-finished:
+					case <-time.After(time.Second):
+						t.Error("service did not exit")
+					}
+				})
+				await := func(value *atomic.Int32, want int32) {
+					t.Helper()
+					for value.Load() != want {
+						select {
+						case <-ctx.Done():
+							t.Fatal("service timeout")
+						case <-time.After(time.Millisecond):
+						}
+					}
+				}
+				send := func(action string) {
+					t.Helper()
+					select {
+					case actions <- action:
+					case <-ctx.Done():
+						t.Fatal("action timeout")
+					}
+				}
+				start := time.Unix(1000, 0)
+				if action := observeLifecycle(t, m, start); action != "start" {
+					t.Fatal(action)
+				} else {
+					send(action)
+				}
+				await(&opened, 1)
+				if mode == "upgrade stop" {
+					write(control, "stop\n")
+					if action := observeLifecycle(t, m, start); action != "stop" {
+						t.Fatal(action)
+					} else {
+						send(action)
+					}
+					await(&closed, 1)
+				}
+				if gap == "directory" {
+					if err := os.Rename(pkg, pkg+".upgrade"); err != nil {
+						t.Fatal(err)
+					}
+				} else if err := os.Remove(info); err != nil {
+					t.Fatal(err)
+				}
+				if action := observeLifecycle(t, m, start); action != "stop" {
+					t.Fatal("gap did not pause", action)
+				} else {
+					send(action)
+				}
+				await(&closed, 1)
+				if conn, err := net.Dial("unix", socket); err == nil {
+					conn.Close()
+					t.Fatal("gap accepted a connection")
+				}
+				if action := observeLifecycle(t, m, start.Add(9*time.Minute)); action != "stop" {
+					t.Fatal("gap resumed or purged", action)
+				}
+				if gap == "directory" {
+					if err := os.Rename(pkg+".upgrade", pkg); err != nil {
+						t.Fatal(err)
+					}
+				} else {
+					write(info, "package=\"TestApp\"\n")
+				}
+				if mode != "same pins" {
+					write(filepath.Join(target, "policy.json"), "new unapproved policy")
+				}
+				want := "start"
+				if mode == "upgrade stop" {
+					want = "stop"
+				}
+				if action := observeLifecycle(t, m, start.Add(9*time.Minute)); action != want {
+					t.Fatalf("reappeared: got %q, want %q", action, want)
+				} else {
+					send(action)
+				}
+				if mode == "same pins" {
+					await(&opened, 2)
+					conn, err := net.Dial("unix", socket)
+					if err != nil {
+						t.Fatal("approved socket did not recover", err)
+					}
+					conn.Close()
+				} else {
+					if mode == "new policy" {
+						select {
+						case <-approval:
+						case <-ctx.Done():
+							t.Fatal("no approval-required result")
+						}
+					}
+					if _, err := os.Stat(socket); !os.IsNotExist(err) {
+						t.Fatal("unapproved socket exposed", err)
+					}
+				}
+				if purged.Load() != 0 {
+					t.Fatal("upgrade purged state")
+				}
+				for _, marker := range markers {
+					if _, err := os.Stat(marker); err != nil {
+						t.Fatal("upgrade lost retained state", err)
+					}
+				}
+				// The real package-account helper writes the preuninst purge mailbox.
+				hookDone := make(chan error, 1)
+				go func() {
+					hookDone <- lifecycle.Run(ctx, lifecycle.Config{Package: "TestApp", Data: data, Socket: socket}, "purge")
+				}()
+				for {
+					b, err := os.ReadFile(control)
+					if err == nil && string(b) == "purge\n" {
+						break
+					}
+					select {
+					case <-ctx.Done():
+						t.Fatal("preuninst mailbox timeout")
+					case <-time.After(time.Millisecond):
+					}
+				}
+				if action := observeLifecycle(t, m, start.Add(9*time.Minute)); action != "purge" {
+					t.Fatal("preuninst purge delayed", action)
+				} else {
+					send(action)
+				}
+				select {
+				case err := <-hookDone:
+					if err != nil {
+						t.Fatal(err)
+					}
+				case <-ctx.Done():
+					t.Fatal("preuninst timeout")
+				}
+				await(&purged, 1)
+				select {
+				case err := <-done:
+					if err != nil {
+						t.Fatal(err)
+					}
+				case <-ctx.Done():
+					t.Fatal("purge timeout")
+				}
+				for _, path := range []string{state, sockDir} {
+					if _, err := os.Stat(path); !os.IsNotExist(err) {
+						t.Fatal("purge remnant", path, err)
+					}
+				}
+			})
+		}
+	}
+}

package/dist/templates/_executor/watch.go

@@ -0,0 +1,156 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+type lifecycleMonitor struct {
+	pkg, packageDir, control string
+	initialStop              os.FileInfo
+	lastControl              os.FileInfo
+	lastValue                string
+	log                      func(string)
+	now                      func() time.Time
+	missingSince             time.Time
+	unavailable              bool
+}
+
+const missingPackageGrace = 10 * time.Minute
+
+func newLifecycleMonitor(pkg, packageDir, control string, log func(string)) *lifecycleMonitor {
+	m := &lifecycleMonitor{pkg: pkg, packageDir: packageDir, control: control, log: log, now: time.Now}
+	// An approved boot/admin start resumes a previous stop. Capture before the
+	// socket is exposed; every subsequent atomic request has a different inode.
+	if b, info, err := readLifecycleFile(control, 64); err == nil && (string(b) == "stop\n" || string(b) == "stop") {
+		m.initialStop = info
+	}
+	return m
+}
+
+// DSM's var link is expected. Resolve its parent, then reject final symlinks,
+// FIFOs and oversized input. Linux openRegular pins all resolved components.
+func readLifecycleFile(path string, limit int) ([]byte, os.FileInfo, error) {
+	parent, err := filepath.EvalSymlinks(filepath.Dir(path))
+	if err != nil {
+		return nil, nil, err
+	}
+	f, err := openRegular(filepath.Join(parent, filepath.Base(path)))
+	if err != nil {
+		return nil, nil, err
+	}
+	defer f.Close()
+	info, err := f.Stat()
+	if err != nil {
+		return nil, nil, err
+	}
+	b, err := readLimited(f, limit)
+	return b, info, err
+}
+func (m *lifecycleMonitor) watch(ctx context.Context, interval time.Duration) string {
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+	lastIssue := ""
+	lastInvalid := ""
+	report := func(issue string) {
+		if issue != lastIssue {
+			m.log(issue)
+		}
+		lastIssue = issue
+	}
+	for {
+		now := m.now()
+		available, missing := false, false
+		info, err := os.Stat(m.packageDir)
+		if os.IsNotExist(err) || err == nil && !info.IsDir() {
+			missing = true
+		} else if err != nil {
+			report("cannot inspect package directory")
+		} else {
+			b, _, err := readLifecycleFile(filepath.Join(m.packageDir, "INFO"), 65536)
+			if os.IsNotExist(err) {
+				missing = true
+			} else if err != nil {
+				report("cannot read package INFO")
+			} else {
+				matches, mismatch := 0, false
+				for _, line := range strings.Split(string(b), "\n") {
+					if strings.HasPrefix(line, "package=") {
+						if line != "package=\""+m.pkg+"\"" {
+							mismatch = true
+						}
+						matches++
+					}
+				}
+				available = matches == 1 && !mismatch
+				missing = !available
+			}
+		}
+		// Keep this timestamp on the monitor: watch returns for actions while
+		// the root process continues polling, including when already paused.
+		if missing {
+			if m.missingSince.IsZero() {
+				m.missingSince = now
+			}
+		} else {
+			// An unreadable path cannot confirm continuous absence either.
+			m.missingSince = time.Time{}
+		}
+		if available && m.unavailable {
+			m.unavailable = false
+			// The listener was paused independently of the mailbox. Re-read
+			// even an unchanged start, and honor a stop captured before boot.
+			m.lastControl = nil
+			m.lastValue = ""
+			m.initialStop = nil
+		}
+		b, controlInfo, controlErr := readLifecycleFile(m.control, 64)
+		if controlErr == nil {
+			action := strings.TrimSuffix(string(b), "\n")
+			switch action {
+			case "purge":
+				m.log("lifecycle control: purge")
+				return "purge"
+			case "stop", "start":
+				if !available {
+					break
+				}
+				if m.lastControl != nil && os.SameFile(m.lastControl, controlInfo) && m.lastControl.ModTime().Equal(controlInfo.ModTime()) && m.lastValue == action {
+					break
+				}
+				old := m.initialStop
+				if action == "start" || old == nil || !os.SameFile(old, controlInfo) || !old.ModTime().Equal(controlInfo.ModTime()) || old.Size() != controlInfo.Size() {
+					m.lastControl = controlInfo
+					m.lastValue = action
+					m.log("lifecycle control: " + action)
+					return action
+				}
+			default:
+				if string(b) != lastInvalid || lastInvalid == "" {
+					m.log(fmt.Sprintf("ignored invalid lifecycle control (%d bytes)", len(b)))
+				}
+				lastInvalid = string(b)
+			}
+		} else if !os.IsNotExist(controlErr) {
+			report("ignored unreadable lifecycle control")
+		}
+		if missing && now.Sub(m.missingSince) >= missingPackageGrace {
+			m.log("package identity absent for 10 minutes: purge")
+			return "purge"
+		}
+		if !available && !m.unavailable {
+			m.unavailable = true
+			m.log("package identity unavailable: paused")
+			return "stop"
+		}
+		select {
+		case <-ctx.Done():
+			return "stop"
+		case <-ticker.C:
+		}
+	}
+}