@synopackageland/cli 0.6.1 → 0.7.0

package/templates/_executor/dsm.go

@@ -135,6 +135,9 @@ func (d *liveDSM) call(ctx context.Context, api, method, version, runner string,
 	}
 	b, err := d.Command.Exec(ctx, "/usr/syno/bin/synowebapi", args)
 	if err != nil {
+		if errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) {
+			return nil, err
+		}
 		return nil, errors.New("DSM command")
 	}
 	return decodeEnvelope(b)
@@ -161,13 +164,21 @@ func (d *liveDSM) Account(ctx context.Context, name string) (Subject, error) {
 	s.Expired = out.Users[0].Expired
 	return s, nil
 }
-func (d *liveDSM) Allow(ctx context.Context, s Subject, app string) error {
+
+// Allow is the executor's offline App Privileges decision. It follows the CGI
+// EntryGate: administrators pass, admin-only refuses everyone else, and
+// app-privilege requires DSM's own allow. Preview lists only effective allows
+// (user, group and everyone rules), so an absent App is allowed only when the
+// package declares no entry mode and DSM therefore never manages its App.
+func (d *liveDSM) Allow(ctx context.Context, s Subject, app, entry string) error {
+	if !contains([]string{"", "admin-only", "app-privilege"}, entry) {
+		return errors.New("entry mode")
+	}
 	data, err := d.call(ctx, "SYNO.Core.AppPriv.App", "preview", "2", "", map[string]any{"username": s.Username})
 	if err != nil {
 		return err
 	}
-	// DSM 7.x omits default-allowed Apps from preview (measured on vt-nas).
-	// An explicit deny/custom entry or malformed/ambiguous response still refuses.
+	// An explicit deny/custom entry or malformed/ambiguous response refuses.
 	var out struct {
 		Apps *[]json.RawMessage `json:"applications"`
 	}
@@ -193,7 +204,10 @@ func (d *liveDSM) Allow(ctx context.Context, s Subject, app string) error {
 	if count > 1 {
 		return errors.New("app ambiguous")
 	}
-	return nil
+	if entry == "" || s.Admin || entry == "app-privilege" && count == 1 {
+		return nil
+	}
+	return errors.New("app denied")
 }
 func (d *liveDSM) ScopeRoot(ctx context.Context, s Subject, scope string) (string, error) {
 	if scope == "home" {
@@ -210,16 +224,15 @@ func (d *liveDSM) ScopeRoot(ctx context.Context, s Subject, scope string) (strin
 	if err != nil {
 		return "", err
 	}
+	// DSM Share.get returns one share and its volume, not Share.list's array.
 	var out struct {
-		Shares []struct {
-			Name string `json:"name"`
-			Path string `json:"path"`
-		} `json:"shares"`
+		Name   string `json:"name"`
+		Volume string `json:"vol_path"`
 	}
-	if json.Unmarshal(data, &out) != nil || len(out.Shares) != 1 || out.Shares[0].Name != name || !cleanPath(out.Shares[0].Path) {
+	if json.Unmarshal(data, &out) != nil || out.Name != name || !validSelectedScope(scope) || !cleanPath(out.Volume) || out.Volume == "/" {
 		return "", errors.New("share")
 	}
-	return filepath.EvalSymlinks(out.Shares[0].Path)
+	return filepath.EvalSymlinks(filepath.Join(out.Volume, out.Name))
 }
 func (d *liveDSM) API(ctx context.Context, runner, op string, p map[string]any) (json.RawMessage, error) {
 	if runner == "" {

package/templates/_executor/dsm_test.go

@@ -5,7 +5,10 @@ import (
 	"errors"
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"path/filepath"
 	"reflect"
+	"strconv"
 	"strings"
 	"testing"
 )
@@ -24,6 +27,25 @@ type cmdStub struct {
 	err   error
 }
 
+func TestDSMCommandDeadlineStaysDistinctFromDenial(t *testing.T) {
+	for _, cause := range []error{context.DeadlineExceeded, errors.New("explicit DSM refusal")} {
+		d := &liveDSM{Command: &cmdStub{err: cause}, Accounts: accountsStub{s: Subject{Username: "alice", UID: 1200, GID: 100, Groups: []int{100}}}}
+		_, err := d.ScopeRoot(context.Background(), Subject{Username: "alice"}, "shared:reports")
+		if errors.Is(err, context.DeadlineExceeded) != errors.Is(cause, context.DeadlineExceeded) {
+			t.Fatal("lost deadline identity", err)
+		}
+		e := &Executor{DSM: d, Policy: Policy{App: "app"}}
+		_, code := e.eligible(context.Background(), "alice", 1200, true)
+		want := "INELIGIBLE"
+		if errors.Is(cause, context.DeadlineExceeded) {
+			want = "EXECUTOR_PAUSED"
+		}
+		if code != want {
+			t.Fatal(code, want)
+		}
+	}
+}
+
 func (c *cmdStub) Exec(ctx context.Context, p string, args []string) ([]byte, error) {
 	c.path = p
 	c.args = args
@@ -69,7 +91,7 @@ func TestDSMAppPrivilege(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			c := &cmdStub{reply: tc.reply}
 			d := &liveDSM{Command: c}
-			err := d.Allow(context.Background(), Subject{Username: "alice"}, "app")
+			err := d.Allow(context.Background(), Subject{Username: "alice"}, "app", "")
 			if (err == nil) != tc.pass {
 				t.Fatal(err)
 			}
@@ -79,6 +101,41 @@ func TestDSMAppPrivilege(t *testing.T) {
 		})
 	}
 }
+
+// Preview lists only effective allows, so an absent App means "not allowed"
+// unless DSM never manages the App (no entry mode). Mirrors the CGI EntryGate.
+func TestDSMAppPrivilegeByEntryMode(t *testing.T) {
+	const (
+		absent    = `{"success":true,"data":{"applications":[{"app_id":"other","privilelge":"allow"}]}}`
+		allowed   = `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"allow"}]}}`
+		denied    = `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"deny"}]}}`
+		allowAll  = `{"success":true,"data":{"applications":[{"app_id":"SYNO.ALLOW.ALL.APPLICATIONS","privilelge":"allow"}]}}`
+		malformed = `{"success":true,"data":{}}`
+	)
+	user, admin := Subject{Username: "alice"}, Subject{Username: "root-admin", Admin: true}
+	for _, tc := range []struct {
+		name, entry, reply string
+		s                  Subject
+		pass               bool
+	}{
+		{"legacy absent", "", absent, user, true},
+		{"app-privilege absent", "app-privilege", absent, user, false},
+		{"app-privilege allowed", "app-privilege", allowed, user, true},
+		{"app-privilege denied", "app-privilege", denied, user, false},
+		{"app-privilege admin", "app-privilege", allowAll, admin, true},
+		{"app-privilege admin malformed", "app-privilege", malformed, admin, false},
+		{"admin-only user allowed rule", "admin-only", allowed, user, false},
+		{"admin-only admin", "admin-only", allowAll, admin, true},
+		{"unknown mode", "everyone", allowed, user, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			d := &liveDSM{Command: &cmdStub{reply: tc.reply}}
+			if err := d.Allow(context.Background(), tc.s, "app", tc.entry); (err == nil) != tc.pass {
+				t.Fatal(err)
+			}
+		})
+	}
+}
 func TestDSMVerify(t *testing.T) {
 	for _, reply := range []string{`{"success":true,"data":{"username":"alice"}}`, `{"success":true,"data":{}}`, `{"success":false}`, strings.Repeat("x", maxRequest+1)} {
 		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -194,3 +251,40 @@ func TestDefaultAppPrivilegeNeverBypassesExplicitDenialOrDisabledAccount(t *test
 		})
 	}
 }
+
+func TestDSMSharedScopeUsesMeasuredGetVolumeContract(t *testing.T) {
+	volume := t.TempDir()
+	volume, err := filepath.EvalSymlinks(volume)
+	if err != nil {
+		t.Fatal(err)
+	}
+	share := filepath.Join(volume, "reports")
+	if err := os.Mkdir(share, 0700); err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct {
+		name, data string
+		pass       bool
+	}{
+		{"DSM single share", `{"name":"reports","vol_path":` + strconv.Quote(volume) + `,"desc":"test","uuid":"fixture"}`, true},
+		{"different share", `{"name":"other","vol_path":` + strconv.Quote(volume) + `}`, false},
+		{"missing volume", `{"name":"reports"}`, false},
+		{"relative volume", `{"name":"reports","vol_path":"relative"}`, false},
+		{"unclean volume", `{"name":"reports","vol_path":"/volume1/../etc"}`, false},
+		{"root volume", `{"name":"reports","vol_path":"/"}`, false},
+		{"null", `null`, false},
+		{"invented list contract", `{"shares":[{"name":"reports","path":` + strconv.Quote(share) + `}]}`, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			cmd := &cmdStub{reply: `{"success":true,"data":` + tc.data + `}`}
+			d := &liveDSM{Command: cmd}
+			root, err := d.ScopeRoot(context.Background(), Subject{}, "shared:reports")
+			if (err == nil) != tc.pass || tc.pass && root != share {
+				t.Fatalf("root=%q err=%v", root, err)
+			}
+			if !reflect.DeepEqual(cmd.args, []string{"--exec", "api=SYNO.Core.Share", "method=get", "version=1", `name="reports"`}) {
+				t.Fatal(cmd.args)
+			}
+		})
+	}
+}

package/templates/_executor/executor.go

@@ -22,17 +22,21 @@ import (
 const version = "1"
 const maxRequest = 64 << 10
 
-var allOps = []string{"status", "delegate.create", "delegate.list", "delegate.revoke", "files.list", "files.info", "files.createFolder", "files.checkPermission", "files.write", "root.run"}
+var allOps = []string{"status", "delegate.create", "delegate.list", "delegate.revoke", "files.list", "files.info", "files.createFolder", "files.checkPermission", "files.write", "files.moveFromStaging", "files.operationStatus", "files.cancelOperation", "delegate.disable", "delegate.enable", "delegate.audit", "root.run"}
 var tokenRE = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$`)
+var destinationRE = regexp.MustCompile(`^[a-z][a-z0-9_-]{0,63}$`)
 var idRE = regexp.MustCompile(`^[a-f0-9]{64}$`)
 
 type Policy struct {
-	Version    int               `json:"v"`
-	Package    string            `json:"package"`
-	App        string            `json:"app"`
-	Scope      string            `json:"scope,omitempty"`
-	Operations []string          `json:"operations"`
-	Root       map[string]string `json:"root,omitempty"`
+	Version      int               `json:"v"`
+	Package      string            `json:"package"`
+	App          string            `json:"app"`
+	Entry        string            `json:"entry,omitempty"`
+	Scope        string            `json:"scope,omitempty"`
+	Operations   []string          `json:"operations"`
+	Destinations []string          `json:"destinations,omitempty"`
+	Lifetime     string            `json:"lifetime,omitempty"`
+	Root         map[string]string `json:"root,omitempty"`
 }
 type Subject struct {
 	Username string `json:"username"`
@@ -44,16 +48,20 @@ type Subject struct {
 	Admin    bool   `json:"admin"`
 }
 type Delegation struct {
-	ID      string    `json:"delegation_id"`
-	Package string    `json:"package"`
-	Subject Subject   `json:"subject"`
-	Job     string    `json:"job_id"`
-	Ops     []string  `json:"ops"`
-	Scope   string    `json:"scope"`
-	Path    string    `json:"path"`
-	Root    string    `json:"root"`
-	Expires time.Time `json:"expires_at"`
-	Revoked bool      `json:"revoked"`
+	ScopeGeneration uint64            `json:"scope_generation,omitempty"`
+	Lifetime        string            `json:"lifetime,omitempty"`
+	DestinationKey  string            `json:"destination,omitempty"`
+	Directory       directoryIdentity `json:"directory,omitempty"`
+	ID              string            `json:"delegation_id"`
+	Package         string            `json:"package"`
+	Subject         Subject           `json:"subject"`
+	Job             string            `json:"job_id"`
+	Ops             []string          `json:"ops"`
+	Scope           string            `json:"scope"`
+	Path            string            `json:"path"`
+	Root            string            `json:"root"`
+	Expires         time.Time         `json:"expires_at"`
+	Revoked         bool              `json:"revoked"`
 }
 type Auth struct {
 	Cookie    string `json:"dsm_cookie,omitempty"`
@@ -95,20 +103,23 @@ type Response struct {
 	Message string `json:"message,omitempty"`
 }
 type Params struct {
-	Job     string   `json:"job_id,omitempty"`
-	Ops     []string `json:"ops,omitempty"`
-	Scope   string   `json:"scope,omitempty"`
-	Path    string   `json:"path,omitempty"`
-	TTL     int64    `json:"ttl_seconds,omitempty"`
-	ID      string   `json:"delegation_id,omitempty"`
-	Staging string   `json:"staging,omitempty"`
-	Dest    string   `json:"dest_dir,omitempty"`
-	Name    string   `json:"name,omitempty"`
+	Lifetime       string   `json:"lifetime,omitempty"`
+	DestinationKey string   `json:"destination,omitempty"`
+	Size           int64    `json:"size,omitempty"`
+	Job            string   `json:"job_id,omitempty"`
+	Ops            []string `json:"ops,omitempty"`
+	Scope          string   `json:"scope,omitempty"`
+	Path           string   `json:"path,omitempty"`
+	TTL            int64    `json:"ttl_seconds,omitempty"`
+	ID             string   `json:"delegation_id,omitempty"`
+	Staging        string   `json:"staging,omitempty"`
+	Dest           string   `json:"dest_dir,omitempty"`
+	Name           string   `json:"name,omitempty"`
 }
 type DSM interface {
 	Verify(context.Context, string, string) (string, error)
 	Account(context.Context, string) (Subject, error)
-	Allow(context.Context, Subject, string) error
+	Allow(context.Context, Subject, string, string) error
 	ScopeRoot(context.Context, Subject, string) (string, error)
 	API(context.Context, string, string, map[string]any) (json.RawMessage, error)
 }
@@ -128,7 +139,10 @@ type Executor struct {
 	Store                        *Store
 	Now                          func() time.Time
 	ExecutorDigest, PolicyDigest string
-	mu                           sync.Mutex // Serializes execution with revoke, including already accepted requests.
+	legacyCalls                  map[string][]chan struct{}
+	copySlot                     chan struct{}
+	commitMu                     sync.Mutex // Durable admission/revoke/disable and bounded publish only.
+	async                        *operationRuntime
 }
 
 func deny(code string) Response {
@@ -231,7 +245,7 @@ func uniqueValue(d *json.Decoder, canonical bool) error {
 }
 func (e *Executor) Connection(parent context.Context, c net.Conn, uid int, peer func(net.Conn) (int, error)) {
 	got, err := peer(c)
-	if err != nil || got != uid {
+	if err != nil || (got != uid && got != 0) {
 		return
 	}
 	c.SetDeadline(time.Now().Add(15 * time.Second))
@@ -249,22 +263,36 @@ func (e *Executor) Connection(parent context.Context, c net.Conn, uid int, peer
 		} else {
 			ctx, cancel := context.WithTimeout(parent, 30*time.Second)
 			defer cancel()
-			out = e.Handle(ctx, req)
+			out = e.handlePeer(ctx, req, got, uid)
 		}
 	}
 	c.SetWriteDeadline(time.Now().Add(5 * time.Second))
 	json.NewEncoder(c).Encode(out)
 }
 func (e *Executor) eligible(ctx context.Context, name string, uid int, files bool) (Subject, string) {
+	moveValidationStage(ctx, "account")
 	s, err := e.DSM.Account(ctx, name)
-	if err != nil || s.Username != name || s.Expired != "normal" || s.Admin || s.UID < 1024 || s.GID < 0 || len(s.Groups) == 0 || (uid >= 0 && s.UID != uid) {
+	if moveValidationDeadline(ctx, err) {
+		return s, "EXECUTOR_PAUSED"
+	}
+	if err != nil || s.Username != name || s.Expired != "normal" || s.UID < 1024 || s.GID < 0 || len(s.Groups) == 0 || (uid >= 0 && s.UID != uid) {
 		return Subject{}, "INELIGIBLE"
 	}
-	if e.DSM.Allow(ctx, s, e.Policy.App) != nil {
+	moveValidationStage(ctx, "app-privilege")
+	if err := e.DSM.Allow(ctx, s, e.Policy.App, e.Policy.Entry); err != nil {
+		if moveValidationDeadline(ctx, err) {
+			return s, "EXECUTOR_PAUSED"
+		}
 		return Subject{}, "APP_DENIED"
 	}
-	if files && e.DSM.Allow(ctx, s, "SYNO.SDS.App.FileStation3.Instance") != nil {
-		return Subject{}, "APP_DENIED"
+	moveValidationStage(ctx, "file-station-privilege")
+	if files {
+		if err := e.DSM.Allow(ctx, s, "SYNO.SDS.App.FileStation3.Instance", ""); err != nil {
+			if moveValidationDeadline(ctx, err) {
+				return s, "EXECUTOR_PAUSED"
+			}
+			return Subject{}, "APP_DENIED"
+		}
 	}
 	return s, ""
 }
@@ -283,8 +311,9 @@ func (e *Executor) verified(ctx context.Context, auth Auth) (Subject, string) {
 	return s, ""
 }
 func (e *Executor) Handle(ctx context.Context, r Request) Response {
-	e.mu.Lock()
-	defer e.mu.Unlock()
+	if isExtension(r.Op) {
+		return e.handleExtension(ctx, r)
+	}
 	if ctx.Err() != nil {
 		return deny("EXECUTOR_PAUSED")
 	}
@@ -309,17 +338,55 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 	if json.Unmarshal(r.Params, &keys) != nil {
 		return deny("INVALID_REQUEST")
 	}
-	allowed := map[string]string{"status": "", "delegate.create": "job_id ops scope path ttl_seconds", "delegate.list": "", "delegate.revoke": "delegation_id job_id", "files.list": "delegation_id job_id path", "files.info": "delegation_id job_id path", "files.createFolder": "delegation_id job_id path name", "files.checkPermission": "delegation_id job_id path", "files.write": "delegation_id job_id staging dest_dir name", "root.run": "name"}
+	allowed := map[string]string{"status": "", "delegate.create": "job_id ops scope path ttl_seconds destination lifetime", "delegate.list": "", "delegate.revoke": "delegation_id job_id", "files.list": "delegation_id job_id path", "files.info": "delegation_id job_id path", "files.createFolder": "delegation_id job_id path name", "files.checkPermission": "delegation_id job_id path", "files.write": "delegation_id job_id staging dest_dir name", "root.run": "name"}
 	for k := range keys {
 		if !contains(strings.Fields(allowed[r.Op]), k) {
 			return deny("INVALID_REQUEST")
 		}
 	}
+	if r.Op == "delegate.create" || strings.HasPrefix(r.Op, "files.") {
+		e.commitMu.Lock()
+		disabled, err := e.Store.Disabled()
+		e.commitMu.Unlock()
+		if err != nil {
+			return deny("STORAGE_ERROR")
+		}
+		if disabled {
+			return deny("disabled")
+		}
+	}
 	switch r.Op {
 	case "status":
-		return success(map[string]any{"executor_digest": e.ExecutorDigest, "policy_digest": e.PolicyDigest, "version": version, "ready": true})
+		e.commitMu.Lock()
+		defer e.commitMu.Unlock()
+		disabled, err := e.Store.Disabled()
+		out := map[string]any{"executor_digest": e.ExecutorDigest, "policy_digest": e.PolicyDigest, "version": version, "ready": err == nil, "disabled": disabled}
+		if e.Policy.Scope == installSelectedScope {
+			state, code := e.selectionLocked()
+			out["scope_state"] = code
+			out["selection"] = nil
+			if code == "" {
+				out["selection"] = map[string]any{"scope": state.Scope, "root": scopeVirtual(state.Scope), "generation": state.Generation}
+			}
+			if code == "STORAGE_ERROR" {
+				out["ready"] = false
+			}
+		}
+		return success(out)
 	case "delegate.create":
-		if !tokenRE.MatchString(p.Job) || p.TTL <= 0 || p.TTL > 86400*30 || len(p.Ops) == 0 || p.Scope != e.Policy.Scope || !cleanPath(p.Path) {
+		long := p.Lifetime == "until-revoked"
+		if long {
+			if _, ok := keys["job_id"]; ok {
+				return deny("INVALID_REQUEST")
+			}
+			if _, ok := keys["ttl_seconds"]; ok {
+				return deny("INVALID_REQUEST")
+			}
+			if !contains(e.Policy.Destinations, p.DestinationKey) {
+				return deny("invalid-destination")
+			}
+		}
+		if (long && (e.Policy.Lifetime != p.Lifetime || !contains(e.Policy.Destinations, p.DestinationKey) || p.Job != "" || p.TTL != 0 || len(p.Ops) != 1 || p.Ops[0] != "files.moveFromStaging")) || (!long && (p.Lifetime != "" || p.DestinationKey != "" || !tokenRE.MatchString(p.Job) || p.TTL <= 0 || p.TTL > 86400*30 || contains(p.Ops, "files.moveFromStaging"))) || len(p.Ops) == 0 || p.Scope != e.Policy.Scope || !cleanPath(p.Path) {
 			return deny("INVALID_REQUEST")
 		}
 		for _, op := range p.Ops {
@@ -335,17 +402,35 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 		if code != "" {
 			return deny(code)
 		}
-		root, err := e.DSM.ScopeRoot(ctx, s, p.Scope)
+		selection, selectionCode := e.selection()
+		if selectionCode != "" {
+			return deny(selectionCode)
+		}
+		root, err := e.DSM.ScopeRoot(ctx, s, selection.Scope)
 		if err != nil {
 			return deny("SCOPE_DENIED")
 		}
-		d := Delegation{Package: e.Policy.Package, Subject: s, Job: p.Job, Ops: p.Ops, Scope: p.Scope, Path: scopeVirtual(p.Scope), Root: root, Expires: e.Now().UTC().Add(time.Duration(p.TTL) * time.Second)}
-		real, err := scopedPath(d, p.Path)
+		d := Delegation{Package: e.Policy.Package, Subject: s, Job: p.Job, Ops: p.Ops, Scope: selection.Scope, ScopeGeneration: selection.Generation, Path: scopeVirtual(selection.Scope), Root: root, Expires: e.Now().UTC().Add(time.Duration(p.TTL) * time.Second)}
+		var real string
+		if long {
+			real, err = mappedDirectory(d, p.Path)
+		} else {
+			real, err = scopedPath(d, p.Path)
+		}
 		if err != nil {
 			return deny("SCOPE_DENIED")
 		}
 		d.Root = real
 		d.Path = p.Path
+		if long {
+			d.Lifetime = p.Lifetime
+			d.DestinationKey = p.DestinationKey
+			d.Expires = time.Time{}
+			d.Directory, err = bindDirectory(real)
+			if err != nil {
+				return deny("SCOPE_DENIED")
+			}
+		}
 		// Permission creation is checked as the subject, never SYSTEM_ADMIN.
 		if _, err = e.DSM.API(ctx, s.Username, "files.checkPermission", map[string]any{"path": p.Path}); err != nil {
 			return deny("PERMISSION_DENIED")
@@ -355,9 +440,49 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 			return deny("INTERNAL")
 		}
 		d.ID = hex.EncodeToString(id)
-		if e.Store.Put(d) != nil {
+		e.commitMu.Lock()
+		disabled, disableErr := e.Store.Disabled()
+		if !e.scopeMatchesLocked(d) {
+			e.commitMu.Unlock()
+			return deny("SCOPE_DENIED")
+		}
+		if disableErr != nil || disabled {
+			e.commitMu.Unlock()
+			return deny("disabled")
+		}
+		putErr := e.auditLocked(s, "delegate.create", "", d.Path, "admitting")
+		// A destination key denotes one current choice for this person. Changing
+		// it cancels its previous grant under the same publish fence.
+		if putErr == nil && long {
+			var previous []Delegation
+			previous, putErr = e.Store.List()
+			for _, prior := range previous {
+				if putErr != nil {
+					break
+				}
+				if prior.Package != d.Package || prior.Subject.UID != s.UID || prior.Subject.Username != s.Username || prior.Lifetime != "until-revoked" || prior.DestinationKey != d.DestinationKey || prior.Revoked {
+					continue
+				}
+				putErr = e.auditLocked(s, "delegate.revoke", prior.ID, prior.Path, "destination-replaced")
+				if putErr == nil {
+					prior.Revoked = true
+					putErr = e.Store.Put(prior)
+				}
+				if putErr == nil {
+					e.cancelGrantLocked(prior.ID, "destination-replaced")
+				}
+			}
+		}
+		if putErr == nil {
+			putErr = e.Store.Put(d)
+		}
+		e.commitMu.Unlock()
+		if putErr != nil {
 			return deny("STORAGE_ERROR")
 		}
+		if long {
+			return success(publicDelegation(d))
+		}
 		return success(map[string]any{"delegation_id": d.ID, "subject": publicSubject(s), "expires_at": d.Expires})
 	case "delegate.list":
 		s, code := e.verified(ctx, r.Auth)
@@ -371,6 +496,9 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 		out := []any{}
 		for _, d := range ds {
 			if d.Package == e.Policy.Package && d.Subject.UID == s.UID && d.Subject.Username == s.Username {
+				if !e.scopeMatches(d) {
+					d.Revoked = true
+				}
 				out = append(out, publicDelegation(d))
 			}
 		}
@@ -385,16 +513,37 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 			if code != "" {
 				return deny(code)
 			}
-			if !s.Admin && (s.UID != d.Subject.UID || s.Username != d.Subject.Username) {
+			if (d.Lifetime != "" || !s.Admin) && (s.UID != d.Subject.UID || s.Username != d.Subject.Username) {
 				return deny("DELEGATION_DENIED")
 			}
-		} else if p.Job == "" || p.Job != d.Job {
+		} else if d.Lifetime != "" || p.Job == "" || p.Job != d.Job {
 			return deny("DELEGATION_DENIED")
 		}
+		e.commitMu.Lock()
+		locked := true
+		defer func() {
+			if locked {
+				e.commitMu.Unlock()
+			}
+		}()
+		d, err = e.Store.Get(p.ID)
+		if err != nil {
+			return deny("STORAGE_ERROR")
+		}
 		d.Revoked = true
 		if e.Store.Put(d) != nil {
 			return deny("STORAGE_ERROR")
 		}
+		e.cancelGrantLocked(d.ID, "grant-revoked")
+		if e.auditLocked(d.Subject, "delegate.revoke", "", d.Path, "revoked") != nil {
+			return deny("STORAGE_ERROR")
+		}
+		pending := e.legacyPendingLocked(d.ID)
+		e.commitMu.Unlock()
+		locked = false
+		if waitLegacy(ctx, pending) != nil {
+			return deny("EXECUTOR_PAUSED")
+		}
 		return success(map[string]any{"revoked": true})
 	case "root.run":
 		if !tokenRE.MatchString(p.Name) {
@@ -411,7 +560,7 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 		if !s.Admin {
 			return deny("ADMIN_REQUIRED")
 		}
-		if e.DSM.Allow(ctx, s, e.Policy.App) != nil {
+		if e.DSM.Allow(ctx, s, e.Policy.App, e.Policy.Entry) != nil {
 			return deny("APP_DENIED")
 		}
 		if e.Runner == nil {
@@ -424,7 +573,7 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 		return success(map[string]any{"output": out})
 	}
 	d, err := e.Store.Get(p.ID)
-	if err != nil || d.Package != e.Policy.Package || d.Revoked || !e.Now().Before(d.Expires) || d.Job != p.Job || !contains(d.Ops, r.Op) || d.Scope != e.Policy.Scope {
+	if err != nil || d.Package != e.Policy.Package || d.Revoked || (d.Lifetime != "" || !e.Now().Before(d.Expires)) || d.Job != p.Job || !contains(d.Ops, r.Op) || !e.scopeMatches(d) {
 		return deny("DELEGATION_DENIED")
 	}
 	s, code := e.eligible(ctx, d.Subject.Username, d.Subject.UID, true)
@@ -461,7 +610,43 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 		if !validName(p.Name) || !validRelative(p.Staging) {
 			return deny("INVALID_REQUEST")
 		}
-		if err = e.Writer.Write(context.WithValue(ctx, writeJobKey{}, p.Job), s, p.Staging, real, p.Name, d.Root); err != nil {
+		release, err := e.acquireCopy(ctx)
+		if err != nil {
+			return deny("EXECUTOR_PAUSED")
+		}
+		defer release()
+		e.commitMu.Lock()
+		disabled, x := e.Store.Disabled()
+		fresh, x2 := e.Store.Get(d.ID)
+		e.commitMu.Unlock()
+		if x != nil || x2 != nil {
+			return deny("STORAGE_ERROR")
+		}
+		if disabled {
+			return deny("disabled")
+		}
+		if fresh.Revoked || ctx.Err() != nil {
+			return deny("DELEGATION_DENIED")
+		}
+		writerCtx := context.WithValue(ctx, writeJobKey{}, p.Job)
+		writerCtx = context.WithValue(writerCtx, legacyPublishKey{}, func(publish func() (MoveReceipt, error)) (MoveReceipt, error) {
+			current, c := e.eligible(ctx, d.Subject.Username, d.Subject.UID, true)
+			if c != "" || !sameIdentity(s, current) {
+				return MoveReceipt{}, errors.New("identity changed")
+			}
+			if _, x := e.DSM.API(ctx, s.Username, "files.checkPermission", map[string]any{"path": p.Dest}); x != nil {
+				return MoveReceipt{}, x
+			}
+			e.commitMu.Lock()
+			defer e.commitMu.Unlock()
+			disabled, x := e.Store.Disabled()
+			fresh, x2 := e.Store.Get(d.ID)
+			if x != nil || x2 != nil || disabled || fresh.Revoked || !e.Now().Before(fresh.Expires) || ctx.Err() != nil {
+				return MoveReceipt{}, errors.New("write fenced")
+			}
+			return publish()
+		})
+		if err = e.Writer.Write(writerCtx, s, p.Staging, real, p.Name, d.Root); err != nil {
 			return deny("WRITE_FAILED")
 		}
 		return success(map[string]any{"path": strings.TrimSuffix(p.Dest, "/") + "/" + p.Name})
@@ -473,6 +658,11 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 		}
 		args["name"] = p.Name
 	}
+	done, code := e.beginLegacy(d)
+	if code != "" {
+		return deny(code)
+	}
+	defer done()
 	out, err := e.DSM.API(ctx, s.Username, r.Op, args)
 	if err != nil {
 		return deny("DSM_FAILED")
@@ -481,7 +671,11 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 }
 func publicSubject(s Subject) any { return map[string]any{"username": s.Username, "uid": s.UID} }
 func publicDelegation(d Delegation) any {
-	return map[string]any{"delegation_id": d.ID, "subject": publicSubject(d.Subject), "job_id": d.Job, "ops": d.Ops, "scope": d.Scope, "path": d.Path, "expires_at": d.Expires, "revoked": d.Revoked}
+	out := map[string]any{"delegation_id": d.ID, "subject": publicSubject(d.Subject), "job_id": d.Job, "ops": d.Ops, "scope": d.Scope, "path": d.Path, "expires_at": d.Expires, "revoked": d.Revoked, "destination": d.DestinationKey, "lifetime": d.Lifetime}
+	if d.ScopeGeneration != 0 {
+		out["scope_generation"] = d.ScopeGeneration
+	}
+	return out
 }
 func scopeVirtual(scope string) string {
 	if scope == "home" {
@@ -522,3 +716,20 @@ func validRelative(p string) bool {
 	}
 	return true
 }
+
+// Permanent destinations reject every symlink component; legacy File Station
+// lookup retains its historical canonical-path semantics.
+func mappedDirectory(d Delegation, p string) (string, error) {
+	base := d.Path
+	if base == "" {
+		base = scopeVirtual(d.Scope)
+	}
+	if base == "" || !cleanPath(d.Root) || !cleanPath(p) || !within(base, p) {
+		return "", errors.New("scope")
+	}
+	real := filepath.Join(d.Root, strings.TrimPrefix(strings.TrimPrefix(p, base), "/"))
+	if _, err := bindDirectory(real); err != nil {
+		return "", err
+	}
+	return real, nil
+}