@synopackageland/cli 0.6.1 → 0.7.0

package/dist/templates/native-go-delegate/backend/internal/delegate/move_test.go

@@ -0,0 +1,351 @@
+package delegate
+
+import (
+	"context"
+	"dsmapp/internal/background"
+	"encoding/json"
+	"golang.org/x/sys/unix"
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+)
+
+func stagedService(t *testing.T) (*Service, MoveParams) {
+	t.Helper()
+	s := service(t, nil)
+	s.Lifetime = "until-revoked"
+	s.Operations = []string{"files.moveFromStaging"}
+	if err := os.MkdirAll(filepath.Join(s.StagingDir, "exports"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(s.StagingDir, "exports", "a"), []byte("abc"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	return s, MoveParams{DelegationID: "grant", JobID: "export-1", Staging: "exports/a", Name: "a", Size: 3}
+}
+func TestMoveFromStagingNoReplayAndPackageCleanupOnlyAfterReceipt(t *testing.T) {
+	s, in := stagedService(t)
+	moves := 0
+	state := "queued"
+	s.Client = fakeExecutor(func(_ context.Context, op string, auth map[string]string, p, out any) error {
+		if len(auth) != 0 {
+			t.Fatal("background operation retained session")
+		}
+		switch op {
+		case "files.moveFromStaging":
+			moves++
+			return json.Unmarshal([]byte(`{"job_id":"export-1","state":"queued"}`), out)
+		case "files.operationStatus":
+			result := OperationResult{JobID: in.JobID, State: state}
+			if state == "committed" {
+				result.Receipt = &Receipt{Path: "/home/a", Size: 3}
+			}
+			data, _ := json.Marshal(result)
+			return json.Unmarshal(data, out)
+		default:
+			t.Fatalf("unexpected operation %s", op)
+			return nil
+		}
+	})
+	out, err := s.MoveFromStaging(context.Background(), in)
+	if err != nil || out.State != "queued" || moves != 1 {
+		t.Fatal(out, err, moves)
+	}
+	if _, err = os.Stat(filepath.Join(s.StagingDir, in.Staging)); err != nil {
+		t.Fatal("removed before commit")
+	}
+	// A CGI/worker restart retains only a reference and exact source identity.
+	s.Store = background.NewStore(filepath.Dir(s.StagingDir) + "/background")
+	if _, err = s.MoveFromStaging(context.Background(), in); err != nil || moves != 1 {
+		t.Fatal("replayed admission", err, moves)
+	}
+	changed := in
+	changed.Name = "b"
+	if _, err = s.MoveFromStaging(context.Background(), changed); err == nil || moves != 1 {
+		t.Fatal("job input changed")
+	}
+	state = "committed"
+	result, err := s.OperationStatus(context.Background(), nil, OperationRef{DelegationID: in.DelegationID, JobID: in.JobID})
+	if err != nil || result.State != "committed" || result.Receipt.Path != "/home/a" {
+		t.Fatal(result, err)
+	}
+	if _, err = os.Stat(filepath.Join(s.StagingDir, in.Staging)); !os.IsNotExist(err) {
+		t.Fatal("committed source not cleaned", err)
+	}
+	if _, err = s.OperationStatus(context.Background(), nil, OperationRef{DelegationID: in.DelegationID, JobID: in.JobID}); err != nil {
+		t.Fatal("cleanup not idempotent", err)
+	}
+	if err = s.Sweep(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+}
+func TestAmbiguousAdmissionQueriesOriginalJobAndNeverMovesAgain(t *testing.T) {
+	s, in := stagedService(t)
+	moves, queries := 0, 0
+	s.Client = fakeExecutor(func(_ context.Context, op string, _ map[string]string, p, out any) error {
+		if op == "files.moveFromStaging" {
+			moves++
+			return fail("EXECUTOR_TIMEOUT")
+		}
+		if op != "files.operationStatus" {
+			t.Fatal(op)
+		}
+		queries++
+		b, _ := json.Marshal(p)
+		var ref OperationRef
+		json.Unmarshal(b, &ref)
+		if ref.JobID != in.JobID || ref.DelegationID != in.DelegationID {
+			t.Fatal("queried new job")
+		}
+		return json.Unmarshal([]byte(`{"job_id":"export-1","state":"uncertain"}`), out)
+	})
+	for i := 0; i < 2; i++ {
+		out, err := s.MoveFromStaging(context.Background(), in)
+		if err != nil || out.State != "uncertain" {
+			t.Fatal(out, err)
+		}
+	}
+	if moves != 1 || queries != 2 {
+		t.Fatal(moves, queries)
+	}
+	if _, err := os.Stat(filepath.Join(s.StagingDir, in.Staging)); err != nil {
+		t.Fatal("uncertain source removed")
+	}
+}
+func TestMoveRejectsPathAttacksAndBoundsBeforeAdmission(t *testing.T) {
+	for _, attack := range []string{"traversal", "absolute", "symlink", "parent-link", "hardlink", "size", "root-name", "fifo", "size-mismatch"} {
+		t.Run(attack, func(t *testing.T) {
+			s, in := stagedService(t)
+			source := filepath.Join(s.StagingDir, in.Staging)
+			switch attack {
+			case "traversal":
+				in.Staging = "../a"
+			case "absolute":
+				in.Staging = source
+			case "symlink":
+				os.Remove(source)
+				os.Symlink("missing", source)
+			case "parent-link":
+				os.Rename(filepath.Join(s.StagingDir, "exports"), filepath.Join(s.StagingDir, "renamed"))
+				os.Symlink("renamed", filepath.Join(s.StagingDir, "exports"))
+			case "hardlink":
+				os.Link(source, filepath.Join(s.StagingDir, "b"))
+			case "size":
+				in.Size = 16<<30 + 1
+			case "root-name":
+				in.Name = "../a"
+			case "fifo":
+				os.Remove(source)
+				if err := unix.Mkfifo(source, 0600); err != nil {
+					t.Fatal(err)
+				}
+			case "size-mismatch":
+				in.Size = 2
+			}
+			s.Client = fakeExecutor(func(context.Context, string, map[string]string, any, any) error {
+				t.Fatal("invalid source admitted")
+				return nil
+			})
+			if _, err := s.MoveFromStaging(context.Background(), in); err == nil {
+				t.Fatal("unsafe move accepted")
+			}
+		})
+	}
+}
+func TestCommittedCleanupFailureDoesNotDowngradeOrDeleteReplacement(t *testing.T) {
+	s, in := stagedService(t)
+	s.Client = fakeExecutor(func(_ context.Context, op string, _ map[string]string, _ any, out any) error {
+		if op == "files.moveFromStaging" {
+			return json.Unmarshal([]byte(`{"job_id":"export-1","state":"queued"}`), out)
+		}
+		return json.Unmarshal([]byte(`{"job_id":"export-1","state":"committed","receipt":{"path":"/home/a","size":3}}`), out)
+	})
+	if _, err := s.MoveFromStaging(context.Background(), in); err != nil {
+		t.Fatal(err)
+	}
+	// Keep original inode alive so this is a definite replacement, not reuse.
+	source := filepath.Join(s.StagingDir, in.Staging)
+	os.Rename(source, source+".old")
+	os.WriteFile(source, []byte("new"), 0600)
+	out, err := s.OperationStatus(context.Background(), nil, OperationRef{DelegationID: in.DelegationID, JobID: in.JobID})
+	if err != nil || out.State != "committed" {
+		t.Fatal("commit downgraded", out, err)
+	}
+	if bytes, err := os.ReadFile(source); err != nil || string(bytes) != "new" {
+		t.Fatal("replacement deleted")
+	}
+}
+func TestConcurrentSameJobAdmitsOnce(t *testing.T) {
+	s, in := stagedService(t)
+	var mu sync.Mutex
+	moves := 0
+	s.Client = fakeExecutor(func(_ context.Context, op string, _ map[string]string, _ any, out any) error {
+		if op == "files.moveFromStaging" {
+			mu.Lock()
+			moves++
+			mu.Unlock()
+		}
+		return json.Unmarshal([]byte(`{"job_id":"export-1","state":"queued"}`), out)
+	})
+	var wg sync.WaitGroup
+	for i := 0; i < 8; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_, err := s.MoveFromStaging(context.Background(), in)
+			if err != nil {
+				t.Error(err)
+			}
+		}()
+	}
+	wg.Wait()
+	if moves != 1 {
+		t.Fatal(moves)
+	}
+}
+
+func TestCanceledOperationRetainsSourceAndReusableGrant(t *testing.T) {
+	s, in := stagedService(t)
+	s.Client = fakeExecutor(func(_ context.Context, op string, auth map[string]string, _ any, out any) error {
+		switch op {
+		case "files.moveFromStaging":
+			return json.Unmarshal([]byte(`{"job_id":"export-1","state":"queued"}`), out)
+		case "files.cancelOperation":
+			if auth["dsm_cookie"] != "owner-cookie" {
+				t.Fatal("owner session not forwarded")
+			}
+			return json.Unmarshal([]byte(`{"job_id":"export-1","state":"canceled"}`), out)
+		default:
+			t.Fatalf("unexpected operation/revocation %s", op)
+			return nil
+		}
+	})
+	if _, err := s.MoveFromStaging(context.Background(), in); err != nil {
+		t.Fatal(err)
+	}
+	out, err := s.CancelOperation(context.Background(), map[string]string{"dsm_cookie": "owner-cookie"}, OperationRef{in.DelegationID, in.JobID})
+	if err != nil || out.State != "canceled" {
+		t.Fatal(out, err)
+	}
+	if _, err = os.Stat(filepath.Join(s.StagingDir, in.Staging)); err != nil {
+		t.Fatal("canceled source removed")
+	}
+}
+
+func TestOperationReceiptAndReferenceMustComeFromExecutor(t *testing.T) {
+	for _, reply := range []string{
+		`{"job_id":"different","state":"committed","receipt":{"path":"/home/a","size":3}}`,
+		`{"job_id":"export-1","state":"succeeded"}`,
+		`{"job_id":"export-1","state":"committed"}`,
+		`{"job_id":"export-1","state":"queued","receipt":{"path":"/home/a","size":3}}`,
+		`{"job_id":"export-1","state":"committed","receipt":{"path":"/home/a","size":4}}`,
+		`{"job_id":"export-1","state":"committed","receipt":{"path":"/home/b","size":3}}`,
+	} {
+		t.Run(reply, func(t *testing.T) {
+			s, in := stagedService(t)
+			s.Client = fakeExecutor(func(_ context.Context, op string, _ map[string]string, _ any, out any) error {
+				if op == "files.moveFromStaging" {
+					return json.Unmarshal([]byte(`{"job_id":"export-1","state":"queued"}`), out)
+				}
+				return json.Unmarshal([]byte(reply), out)
+			})
+			if _, err := s.MoveFromStaging(context.Background(), in); err != nil {
+				t.Fatal(err)
+			}
+			if _, err := s.OperationStatus(context.Background(), nil, OperationRef{in.DelegationID, in.JobID}); err == nil {
+				t.Fatal("invalid result accepted")
+			}
+			if _, err := os.Stat(filepath.Join(s.StagingDir, in.Staging)); err != nil {
+				t.Fatal("invalid receipt cleaned source")
+			}
+		})
+	}
+}
+
+func TestSourceAndParentReplacementNeverCleanedAfterCommit(t *testing.T) {
+	for _, kind := range []string{"parent", "root", "contents"} {
+		t.Run(kind, func(t *testing.T) {
+			s, in := stagedService(t)
+			s.Client = fakeExecutor(func(_ context.Context, op string, _ map[string]string, _ any, out any) error {
+				if op == "files.moveFromStaging" {
+					return json.Unmarshal([]byte(`{"job_id":"export-1","state":"queued"}`), out)
+				}
+				return json.Unmarshal([]byte(`{"job_id":"export-1","state":"committed","receipt":{"path":"/home/a","size":3}}`), out)
+			})
+			if _, err := s.MoveFromStaging(context.Background(), in); err != nil {
+				t.Fatal(err)
+			}
+			switch kind {
+			case "parent":
+				os.Rename(filepath.Join(s.StagingDir, "exports"), filepath.Join(s.StagingDir, "old"))
+				os.Mkdir(filepath.Join(s.StagingDir, "exports"), 0700)
+				os.WriteFile(filepath.Join(s.StagingDir, in.Staging), []byte("new"), 0600)
+			case "root":
+				os.Rename(s.StagingDir, s.StagingDir+".old")
+				os.MkdirAll(filepath.Join(s.StagingDir, "exports"), 0700)
+				os.WriteFile(filepath.Join(s.StagingDir, in.Staging), []byte("new"), 0600)
+			case "contents":
+				os.WriteFile(filepath.Join(s.StagingDir, in.Staging), []byte("new content"), 0600)
+			}
+			out, err := s.OperationStatus(context.Background(), nil, OperationRef{in.DelegationID, in.JobID})
+			if err != nil || out.State != "committed" {
+				t.Fatal(out, err)
+			}
+			if _, err = os.Stat(filepath.Join(s.StagingDir, in.Staging)); err != nil {
+				t.Fatal("changed object removed")
+			}
+		})
+	}
+}
+
+func TestFrozenV1MoveVectorUsesExistingUnixClient(t *testing.T) {
+	s, in := stagedService(t)
+	in.JobID = "export-20261009"
+	in.DelegationID = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	requests := 0
+	s.Client = executor(t, func(request Request) string {
+		requests++
+		var got MoveParams
+		if json.Unmarshal(request.Params, &got) != nil || request.V != 1 || request.Op != "files.moveFromStaging" || len(request.Auth) != 0 || got != in {
+			t.Errorf("unexpected v1 request")
+		}
+		return `{"ok":true,"result":{"job_id":"export-20261009","state":"queued"}}` + "\n"
+	})
+	out, err := s.MoveFromStaging(context.Background(), in)
+	if err != nil || out.JobID != in.JobID || out.State != "queued" || requests != 1 {
+		t.Fatal(out, err, requests)
+	}
+}
+
+func TestRepeatedCommittedMoveReturnsOnlyAdmissionReference(t *testing.T) {
+	s, in := stagedService(t)
+	s.Client = fakeExecutor(func(_ context.Context, op string, _ map[string]string, _ any, out any) error {
+		if op == "files.moveFromStaging" {
+			return json.Unmarshal([]byte(`{"job_id":"export-1","state":"queued"}`), out)
+		}
+		return json.Unmarshal([]byte(`{"job_id":"export-1","state":"committed","receipt":{"path":"/home/a","size":3}}`), out)
+	})
+	if _, err := s.MoveFromStaging(context.Background(), in); err != nil {
+		t.Fatal(err)
+	}
+	out, err := s.MoveFromStaging(context.Background(), in)
+	if err != nil || out.State != "committed" {
+		t.Fatal(out, err)
+	}
+	data, _ := json.Marshal(out)
+	if string(data) != `{"job_id":"export-1","state":"committed"}` {
+		t.Fatal("admission leaked status DTO", string(data))
+	}
+}
+
+func TestNewSemanticRefusalsUseFrozenCodes(t *testing.T) {
+	s, in := stagedService(t)
+	in.Size = MaxMoveBytes + 1
+	_, err := s.MoveFromStaging(context.Background(), in)
+	code(t, err, "invalid-size")
+	s.SessionFiles = &fakeSession{}
+	s.Destinations = []string{"save"}
+	_, err = s.SelectDestination(context.Background(), destinationCaller(t, "alice"), destinationRequest(), SelectDestinationParams{Key: "other", Path: "/home"})
+	code(t, err, "invalid-destination")
+}

package/dist/templates/native-go-delegate/backend/internal/delegate/operations_list.go

@@ -0,0 +1,65 @@
+package delegate
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"sort"
+)
+
+// Mirror metadata is not executor completion evidence. Unknown/pending and
+// settled-without-cleanup records stay uncertain until explicit live status.
+type MoveMirror struct {
+	JobID        string `json:"job_id"`
+	DelegationID string `json:"delegation_id"`
+	Name         string `json:"name"`
+	State        string `json:"state"`
+	Refusal      string `json:"refusal,omitempty"`
+}
+
+func (s *Service) listOperations(ctx context.Context, caller api.Caller, auth map[string]string) (any, error) {
+	owner, err := s.owner(caller)
+	if err != nil {
+		return nil, err
+	}
+	var grants struct {
+		Delegations []Grant `json:"delegations"`
+	}
+	if err = s.Client.Call(ctx, "delegate.list", auth, nil, &grants); err != nil {
+		return nil, err
+	}
+	owned := map[string]bool{}
+	for _, grant := range grants.Delegations {
+		if grant.Subject.Username == owner.User && grant.Subject.UIDString() == owner.UID {
+			owned[grant.DelegationID] = true
+		}
+	}
+	if s.Store == nil {
+		return nil, fail("STAGING_UNAVAILABLE")
+	}
+	bindings, err := s.Store.MoveBindings(ctx)
+	if err != nil {
+		return nil, jobError(err)
+	}
+	out := []MoveMirror{}
+	for _, binding := range bindings {
+		if !owned[binding.DelegationID] {
+			continue
+		}
+		var in MoveParams
+		if strict(binding.Params, &in) != nil || !validMove(in) || in.JobID != binding.JobID || in.DelegationID != binding.DelegationID {
+			return nil, fail("jobs_unavailable")
+		}
+		state := "uncertain"
+		if binding.CleanupDone {
+			state = "committed"
+		} else if binding.Refusal != "" {
+			state = "interrupted"
+		}
+		if binding.Refusal != "" && !stableCode.MatchString(binding.Refusal) {
+			return nil, fail("jobs_unavailable")
+		}
+		out = append(out, MoveMirror{JobID: binding.JobID, DelegationID: binding.DelegationID, Name: in.Name, State: state, Refusal: binding.Refusal})
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].JobID < out[j].JobID })
+	return map[string]any{"operations": out}, nil
+}

package/dist/templates/native-go-delegate/backend/internal/delegate/operations_list_test.go

@@ -0,0 +1,114 @@
+package delegate
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"dsmapp/internal/background"
+	"encoding/json"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func mirrorRPC(t *testing.T, s *Service, user, params, token string) map[string]any {
+	t.Helper()
+	server, err := api.NewServerWithPermissions(contractIdentity(user), []byte(`{"schema":1,"default":"administrators","methods":{}}`), s.Routes()...)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r := httptest.NewRequest("POST", "/", strings.NewReader(`{"method":"delegate.operations.list","params":`+params+`}`))
+	r.Header.Set("Content-Type", "application/json")
+	r.Header.Set("Cookie", "id="+user)
+	r.Header.Set("X-SYNO-TOKEN", token)
+	w := httptest.NewRecorder()
+	server.ServeHTTP(w, r)
+	var out map[string]any
+	if json.Unmarshal(w.Body.Bytes(), &out) != nil {
+		t.Fatal(w.Body.String())
+	}
+	return out
+}
+func TestOperationListUsesMirrorsAndFreshExactOwnerEvenForAdmin(t *testing.T) {
+	s := service(t, nil)
+	s.LookupUID = func(user string) string {
+		switch user {
+		case "alice":
+			return "1205"
+		case "bob":
+			return "1206"
+		case "admin":
+			return "1207"
+		}
+		return ""
+	}
+	for _, key := range []string{"alice-job", "bob-job", "admin-job", "refused-job"} {
+		id := strings.Split(key, "-")[0]
+		if key == "refused-job" {
+			id = "alice"
+		}
+		in := MoveParams{DelegationID: id, JobID: key, Staging: key, Name: key + ".csv", Size: 3}
+		raw, _ := json.Marshal(in)
+		if _, _, err := s.Store.ReserveMove(context.Background(), background.MoveBinding{JobID: key, DelegationID: id, Params: raw}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := s.Store.FinishMoveMirror(context.Background(), "alice-job", true, ""); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.Store.FinishMoveMirror(context.Background(), "refused-job", false, "invalid-size"); err != nil {
+		t.Fatal(err)
+	}
+	calls := 0
+	s.Client = fakeExecutor(func(_ context.Context, op string, auth map[string]string, in, out any) error {
+		calls++
+		if op != "delegate.list" || auth["dsm_synotoken"] != "valid" {
+			t.Fatal(op, auth)
+		}
+		// Deliberately include all owners: the backend must still compare both names and UIDs.
+		return json.Unmarshal([]byte(`{"delegations":[{"delegation_id":"alice","subject":{"username":"alice","uid":1205}},{"delegation_id":"bob","subject":{"username":"bob","uid":1206}},{"delegation_id":"admin","subject":{"username":"admin","uid":1207}}]}`), out)
+	})
+	for _, user := range []string{"alice", "bob", "admin"} {
+		out := mirrorRPC(t, s, user, `{}`, "valid")
+		if out["success"] != true {
+			t.Fatal(out)
+		}
+		jobs := out["data"].(map[string]any)["operations"].([]any)
+		want := 1
+		if user == "alice" {
+			want = 2
+		}
+		if len(jobs) != want {
+			t.Fatal(user, jobs)
+		}
+		for _, raw := range jobs {
+			job := raw.(map[string]any)
+			if job["delegation_id"] != user || job["name"] == nil || job["state"] == nil || job["receipt"] != nil || job["source"] != nil || job["params"] != nil {
+				t.Fatal(user, job)
+			}
+			if job["job_id"] == "alice-job" && job["state"] != "committed" {
+				t.Fatal(job)
+			}
+			if job["job_id"] == "refused-job" && (job["state"] != "interrupted" || job["refusal"] != "invalid-size") {
+				t.Fatal(job)
+			}
+		}
+	}
+	before := calls
+	for _, bad := range []string{`{"uid":1205}`, `{"owner":"alice"}`, `{"limit":1}`, `null`} {
+		if out := mirrorRPC(t, s, "alice", bad, "valid"); out["success"] != false || calls != before {
+			t.Fatal("nonempty input reached executor", bad, out)
+		}
+	}
+	if out := mirrorRPC(t, s, "alice", `{}`, ""); out["success"] != false || calls != before {
+		t.Fatal("missing session", out)
+	}
+	// Current UID change cannot inherit even an identically named mirror/grant.
+	s.LookupUID = func(string) string { return "9999" }
+	if out := mirrorRPC(t, s, "alice", `{}`, "valid"); out["success"] != true || len(out["data"].(map[string]any)["operations"].([]any)) != 0 {
+		t.Fatal(out)
+	}
+	s.Client = fakeExecutor(func(context.Context, string, map[string]string, any, any) error { return fail("AUTH_DENIED") })
+	if out := mirrorRPC(t, s, "alice", `{}`, "valid"); out["success"] != false {
+		t.Fatal("stale list fallback", out)
+	}
+}

package/dist/templates/native-go-delegate/backend/internal/delegate/retry_test.go

@@ -66,7 +66,7 @@ func TestExecutorAppearsAfterBootDelay(t *testing.T) {
 		*now = now.Add(d)
 		if now.Sub(start) >= 100*time.Second {
 			// The configured socket path itself appears late; client configuration stays fixed.
-			if err := os.Rename(ready.Socket, s.Client.Socket); err != nil {
+			if err := os.Rename(ready.Socket, s.Client.(*Client).Socket); err != nil {
 				t.Fatal(err)
 			}
 		}

package/dist/templates/native-go-delegate/backend/internal/delegate/service.go

@@ -38,27 +38,47 @@ func (s *Subject) UnmarshalJSON(b []byte) error {
 }
 
 type Grant struct {
-	DelegationID string    `json:"delegation_id"`
-	Subject      Subject   `json:"subject"`
-	ExpiresAt    time.Time `json:"expires_at"`
+	DelegationID    string    `json:"delegation_id"`
+	Subject         Subject   `json:"subject"`
+	ExpiresAt       time.Time `json:"expires_at"`
+	Lifetime        string    `json:"lifetime,omitempty"`
+	Destination     string    `json:"destination,omitempty"`
+	Path            string    `json:"path,omitempty"`
+	Scope           string    `json:"scope,omitempty"`
+	ScopeGeneration uint64    `json:"scope_generation,omitempty"`
+	Revoked         bool      `json:"revoked"`
 }
 type Capability struct {
-	State  string `json:"state"`
-	Reason string `json:"reason,omitempty"`
+	State        string          `json:"state"`
+	Reason       string          `json:"reason,omitempty"`
+	Disabled     *bool           `json:"disabled,omitempty"`
+	Lifetime     string          `json:"lifetime,omitempty"`
+	Destinations []string        `json:"destinations,omitempty"`
+	ScopeMode    string          `json:"scope_mode,omitempty"`
+	Preselection string          `json:"preselection,omitempty"`
+	Selection    *ScopeSelection `json:"selection,omitempty"`
+	Mismatch     bool            `json:"mismatch,omitempty"`
 }
 type ExecutorStatus struct {
-	ExecutorDigest string `json:"executor_digest"`
-	PolicyDigest   string `json:"policy_digest"`
-	Version        string `json:"version"`
-	Ready          bool   `json:"ready"`
+	ExecutorDigest string          `json:"executor_digest"`
+	PolicyDigest   string          `json:"policy_digest"`
+	Version        string          `json:"version"`
+	Ready          bool            `json:"ready"`
+	Disabled       *bool           `json:"disabled"`
+	Selection      *ScopeSelection `json:"selection"`
+	ScopeState     string          `json:"scope_state"`
 }
 type Service struct {
 	ExecutorDigest, PolicyDigest string
-	Client                       *Client
+	Client                       ExecutorClient
 	Store                        *background.Store
 	Scope, StagingDir            string
 	LookupUID                    func(string) string
 	HTTP                         *http.Client
+	SessionFiles                 DestinationSession
+	Destinations, Operations     []string
+	Lifetime                     string
+	InstallDraftPath             string
 	now                          func() time.Time
 	wait                         func(context.Context, time.Duration) error
 }
@@ -89,7 +109,8 @@ func strict(raw json.RawMessage, out any) error {
 	}
 	return nil
 }
-func (s *Service) Status(ctx context.Context) Capability {
+func (s *Service) Status(ctx context.Context) (result Capability) {
+	defer func() { s.decorateScope(&result) }()
 	var out ExecutorStatus
 	e := s.Client.Call(ctx, "status", nil, nil, &out)
 	if e != nil {
@@ -99,10 +120,23 @@ func (s *Service) Status(ctx context.Context) Capability {
 		}
 		return Capability{State: "blocked", Reason: "executor-status-refused"}
 	}
-	if (s.ExecutorDigest != "" && out.ExecutorDigest != s.ExecutorDigest) || (s.PolicyDigest != "" && out.PolicyDigest != s.PolicyDigest) || !out.Ready || out.ExecutorDigest == "" || out.PolicyDigest == "" || out.Version == "" {
+	if (s.ExecutorDigest != "" && out.ExecutorDigest != s.ExecutorDigest) || (s.PolicyDigest != "" && out.PolicyDigest != s.PolicyDigest) || !out.Ready || out.Disabled == nil || out.ExecutorDigest == "" || out.PolicyDigest == "" || out.Version == "" {
 		return Capability{State: "blocked", Reason: "executor-not-ready"}
 	}
-	return Capability{State: "ready"}
+	selection := &ScopeSelection{Scope: s.Scope, Root: virtualScope(s.Scope)}
+	if s.Scope == "install-selected" {
+		selection = out.Selection
+		if selection == nil && out.ScopeState == "needs-scope-confirmation" {
+			return Capability{State: "needs-scope-confirmation", Disabled: out.Disabled}
+		}
+		if out.ScopeState != "" || !validSelection(selection, true) {
+			return Capability{State: "blocked", Reason: "executor-scope-invalid"}
+		}
+	}
+	if *out.Disabled {
+		return Capability{State: "disabled", Disabled: out.Disabled, Selection: selection}
+	}
+	return Capability{State: "ready", Disabled: out.Disabled, Selection: selection}
 }
 
 type CreateParams struct {
@@ -149,7 +183,7 @@ func (s *Service) Sweep(ctx context.Context) error {
 		}
 		result = errors.Join(result, e)
 	}
-	return result
+	return errors.Join(result, s.SweepMoves(ctx))
 }
 func (s *Service) Routes() []api.Route {
 	routes := []api.Route{}
@@ -159,7 +193,7 @@ func (s *Service) Routes() []api.Route {
 			return s.handle(ctx, c, r, m, p)
 		}))
 	}
-	return routes
+	return append(routes, s.longRunningRoutes()...)
 }
 func (s *Service) handle(ctx context.Context, c api.Caller, r *http.Request, method string, p json.RawMessage) (any, error) {
 	if !c.Authenticated() {
@@ -170,7 +204,10 @@ func (s *Service) handle(ctx context.Context, c api.Caller, r *http.Request, met
 		if e := strict(p, &struct{}{}); e != nil {
 			return nil, e
 		}
-		return s.Status(ctx), nil
+		out := s.Status(ctx)
+		out.Lifetime = s.Lifetime
+		out.Destinations = append([]string(nil), s.Destinations...)
+		return out, nil
 	case "delegate.create":
 		var in CreateParams
 		if e := strict(p, &in); e != nil {
@@ -285,6 +322,10 @@ func (s *Service) handle(ctx context.Context, c api.Caller, r *http.Request, met
 	}
 	return nil, fail("unsupported")
 }
+
+// jobError maps a store failure to a stable code. jobs_busy, canceled and
+// jobs_unavailable wrote nothing a retry could duplicate; spool_unsafe and
+// journal_corrupt stay terminal until the spool is repaired.
 func jobError(e error) error {
 	if e == nil {
 		return nil
@@ -293,7 +334,7 @@ func jobError(e error) error {
 	if errors.As(e, &a) {
 		return e
 	}
-	codes := map[error]string{background.ErrBusy: "jobs_busy", background.ErrNotFound: "not_found", background.ErrNotCancelable: "not_cancelable", background.ErrKeyConflict: "key_conflict", background.ErrOwnerQueueFull: "queue_full", background.ErrQueueFull: "queue_full", background.ErrOwnerQuota: "quota", background.ErrQuota: "quota", background.ErrInvalid: "invalid-request"}
+	codes := map[error]string{context.Canceled: "canceled", context.DeadlineExceeded: "canceled", background.ErrUnsafeSpool: "spool_unsafe", background.ErrJournalUnreadable: "journal_corrupt", background.ErrJournalSchema: "journal_corrupt", background.ErrBusy: "jobs_busy", background.ErrNotFound: "not_found", background.ErrNotCancelable: "not_cancelable", background.ErrKeyConflict: "key_conflict", background.ErrOwnerQueueFull: "queue_full", background.ErrQueueFull: "queue_full", background.ErrOwnerQuota: "quota", background.ErrQuota: "quota", background.ErrInvalid: "invalid-request"}
 	for err, code := range codes {
 		if errors.Is(e, err) {
 			return fail(code)