@synopackageland/cli 0.6.1 → 0.7.1

package/dist/standalone/root-window.js

@@ -1,28 +1,47 @@
 import { bootDefinition, controlDefinition } from '../runtime/executor-tasks.js';
+import { executorScopeTask } from '../runtime/executor-scope-task.js';
+import { versionUnsupported } from '../runtime/dsm-version.js';
 export { executorTasks as rootTasks } from '../runtime/executor-tasks.js';
 /** Exact readback is authoritative. PasswordConfirm tokens are reused immediately,
  * across both Root APIs, and never persisted (DSM validity is about 300 seconds). */
 export const ROOT_RUNTIME = `function createRootAccess(options) {
   var eventAPI = "SYNO.Core.EventScheduler", taskAPI = "SYNO.Core.TaskScheduler";
-  var busy = null;
-  function fail(code) { var e = new Error(code); e.code = code; return e; }
+  var busy = null, legacy = false;
+  var versionUnsupported = ${versionUnsupported.toString()};
+  function fail(code, detail) { var e = new Error(code); e.code = code; if (detail) e.detail = detail; return e; }
   function reason(e) {
     var code = String(e && e.code || "executor_bad_response");
+    if (e && e.passwordConfirm) return code + (code === "dsm_3121" ? ": DSM rejected the administrator password." : ": administrator password confirmation failed.") + " Nothing was created.";
+    if (e && e.detail) return code + ": " + e.detail;
     return code + (code === "105" || code === "dsm_105" ? ": DSM denied administrator scheduler access. Check the DSM session and scheduler; a NAS restart resolved this on the measured DSM. No automatic retry was made." : ": scheduler readback or operation failed.");
   }
-  function wire(params) {
-    var encoded = {};
-    Object.keys(params).forEach(function (key) {
-      var value = params[key];
-      encoded[key] = value === "" || typeof value === "boolean" || typeof value === "object" ? JSON.stringify(value) : value;
+  // AppWindow.sendWebAPI encodes JSON parameters. Preserve their native types;
+  // pre-encoding turns objects/booleans into strings and DSM rejects create.
+  function send(api, method, version, params) { return options.send(api, method, version, params || {}); }
+  // DSM 7.1 has no Root APIs: TaskScheduler stops at list v2 (offset) and get v3.
+  // Only an unsupported method version on a read selects that profile, which
+  // then creates through the plain scheduler APIs. Writes never fall back.
+  function taskRead(method, version, params, legacyVersion, legacyParams) {
+    if (legacy) return send(taskAPI, method, legacyVersion, legacyParams);
+    return send(taskAPI, method, version, params).catch(function (e) {
+      if (!versionUnsupported(e && e.code)) throw e;
+      legacy = true;
+      return send(taskAPI, method, legacyVersion, legacyParams);
     });
-    return encoded;
   }
-  function send(api, method, version, params) { return options.send(api, method, version, wire(params || {})); }
+  function create(boot, params, confirmation) {
+    if (legacy) return send(boot ? eventAPI : taskAPI, "create", boot ? 1 : 3, params);
+    params.SynoConfirmPWToken = confirmation.token;
+    return send(boot ? eventAPI + ".Root" : taskAPI + ".Root", "create", boot ? 1 : 4, params);
+  }
+  function remove(task, ref) {
+    var boot = task.kind === "boot";
+    return send(boot ? eventAPI : taskAPI, "delete", boot ? 1 : 2, boot ? ref : {tasks: [ref]});
+  }
   function admin() { if (!options.user() || options.user().admin !== true) throw fail("admin_required"); }
   function find(task) {
     var boot = task.kind === "boot";
-    return send(boot ? eventAPI : taskAPI, "list", boot ? 1 : 3, boot ? {} : {start: 0, limit: 500}).then(function (data) {
+    return (boot ? send(eventAPI, "list", 1, {}) : taskRead("list", 3, {start: 0, limit: 500}, 2, {offset: 0, limit: 500})).then(function (data) {
       var records = boot ? data : data && data.tasks;
       if (!Array.isArray(records) || records.length > 500 || (!boot && (!Number.isInteger(data.total) || data.total !== records.length))) throw fail("executor_bad_response");
       var named = records.filter(function (r) { return r && (boot ? r.task_name : r.name) === task.name; });
@@ -31,7 +50,7 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       var summary = named[0];
       if (!boot && !/^[0-9]+$/.test(String(summary.id))) throw fail("executor_bad_response");
       var ref = boot ? {task_name: task.name} : {id: summary.id, real_owner: "root"};
-      var detail = send(boot ? eventAPI : taskAPI, "get", boot ? 1 : 4, ref);
+      var detail = boot ? send(eventAPI, "get", 1, ref) : taskRead("get", 4, ref, 3, ref);
       return detail.then(function (r) {
         var owner = r && r.owner;
         var root = owner === "root" || (boot && owner && owner["0"] === "root");
@@ -54,15 +73,30 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       return result;
     });
   }
+  // Removes, newest first, the tasks one approval created and still reads as
+  // exactly ours. Resolves with the last refusal's reason, if any.
+  function withdraw(created) {
+    var failed;
+    return created.reduceRight(function (withdrawn, task) {
+      return withdrawn.then(function () { return find(task); }).then(function (current) {
+        if (current.state === "ready") return remove(task, current.ref);
+      }).catch(function (e) { failed = reason(e); });
+    }, Promise.resolve()).then(function () { return failed; });
+  }
   function definition(task) { return task.kind === "boot" ? (${bootDefinition.toString()})(task) : (${controlDefinition.toString()})(task); }
-  function approve(password) {
+  function approve(password, selectedScope) {
+    var selectionTask;
+    if (selectedScope !== undefined) selectionTask = (${executorScopeTask.toString()})(options.pins, selectedScope, options.user() && options.user().name, 0);
     return read().then(function (before) {
       if (before.state === "blocked" || before.state === "unsupported") return before;
-      if (before.state === "ready") return start(before);
-      return options.confirmPassword(password).then(function (confirmation) {
+      if (before.state === "ready" && !selectionTask) return start(before);
+      return options.confirmPassword(password).catch(function (e) {
+        throw {code: e && e.code, passwordConfirm: true};
+      }).then(function (confirmation) {
         if (!confirmation || confirmation.confirmed !== true) return {state: "cancelled", tasks: before.tasks};
-        if (typeof confirmation.token !== "string" || !confirmation.token) throw fail("executor_confirmation_missing");
-        var errors = {};
+        // DSM 7.1 confirms the password server-side but issues no create token.
+        if (!legacy && (typeof confirmation.token !== "string" || !confirmation.token)) throw fail("executor_confirmation_missing");
+        var errors = {}, created = [], withdrawFailed;
         // Delete only a verified, same-header outdated task, then create the pinned
         // replacement. set has no measured wire contract. Re-read before each write.
         var chain = Promise.resolve();
@@ -71,32 +105,106 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
             return find(task).then(function (current) {
               if (current.state === "ready") return;
               if (current.state === "blocked") throw fail(current.reason);
-              var boot = task.kind === "boot";
-              var removed = current.ref ? send(boot ? eventAPI : taskAPI, "delete", boot ? 1 : 2, boot ? current.ref : {tasks: [current.ref]}) : Promise.resolve();
-              return removed.then(function () {
-                var params = definition(task); params.SynoConfirmPWToken = confirmation.token;
-                return send(boot ? eventAPI + ".Root" : taskAPI + ".Root", "create", boot ? 1 : 4, params);
-              });
+              var removed = current.ref ? remove(task, current.ref) : Promise.resolve();
+              return removed.then(function () { return create(task.kind === "boot", definition(task), confirmation); }).then(function () { created.push(task); });
             }).catch(function (e) { errors[task.kind] = reason(e); });
           });
         });
-        return chain.then(read).then(function (after) {
+        // A partial approval must not leave an enabled root bootup task that no
+        // control task or uninstall inventory owns: withdraw what it created.
+        return chain.then(function () {
+          if (Object.keys(errors).length) return withdraw(created).then(function (failed) { withdrawFailed = failed; });
+        }).then(read).then(function (after) {
           Object.keys(errors).forEach(function (kind) {
             if (after.tasks[kind].state !== "ready") { after.tasks[kind].state = "blocked"; after.tasks[kind].reason = errors[kind]; after.state = "blocked"; after.reason = errors[kind]; }
           });
-          return after.state === "ready" ? start(after) : after;
+          if (withdrawFailed) { after.state = "blocked"; after.reason = (after.reason ? after.reason + " " : "") + "Withdrawing the tasks this approval created failed: " + withdrawFailed; }
+          // A scope change must not restart a running executor: the boot task
+          // stops it, which interrupts in-flight copies instead of canceling them.
+          return after.state === "ready" ? (selectionTask ? running(after) : Promise.resolve(null)).then(function (live) { return live || start(after); }).then(function (started) {
+            // Without a running executor there is no task inventory, so uninstall
+            // cannot find these tasks: withdraw what this approval created.
+            if (started.state === "ready" || !created.length) return started;
+            return withdraw(created).then(function (failed) {
+              return read().then(function (current) {
+                current.state = "blocked";
+                current.reason = started.reason + (failed ? " Withdrawing the tasks this approval created failed: " + failed : " The tasks this approval created were withdrawn.");
+                current.retry = !failed;
+                return current;
+              });
+            });
+          }).then(function (started) {
+            if (!selectionTask || started.state !== "ready") return started;
+            var generation = started.executor.selection ? started.executor.selection.generation : 0;
+            if (started.executor.selection && (!Number.isSafeInteger(generation) || generation <= 0)) throw fail("executor_selection_invalid");
+            selectionTask = (${executorScopeTask.toString()})(options.pins, selectedScope, options.user() && options.user().name, generation);
+            // The root task may still land after this reply. requested lets the
+            // app converge by readback: applied once status().executor.selection
+            // shows this scope above this generation. A resubmit is pinned and safe.
+            return selectScope(selectionTask, confirmation, started, selectedScope).catch(function (e) {
+              return {state: "blocked", reason: reason(e), tasks: started.tasks, requested: {scope: selectedScope, generation: generation}};
+            });
+          }) : after;
         });
       });
     });
   }
-  function health(verified, attempts) {
+  function selectScope(task, confirmation, verified, selectedScope) {
+    function removeExact() {
+      return find(task).then(function (current) {
+        if (current.state === "ready") return remove(task, current.ref);
+        if (current.ref) throw fail("executor_selection_cleanup_conflict");
+      });
+    }
+    return find(task).then(function (current) {
+      if (current.state === "blocked" || current.state === "unsupported") throw fail("executor_selection_conflict");
+      var removed = current.ref ? remove(task, current.ref) : Promise.resolve();
+      return removed.then(function () { return create(false, definition(task), confirmation); });
+    }).then(function () { return find(task); }).then(function (current) {
+      if (current.state !== "ready") throw fail("executor_selection_readback_mismatch");
+      return send(taskAPI, "run", 2, {tasks: [current.ref]});
+    }).then(function () {
+      function readSelection(attempts) {
+        return health(verified, 0).then(function (current) {
+          if (current.state === "ready" && current.executor.selection && current.executor.selection.scope === selectedScope && Number.isSafeInteger(current.executor.selection.generation) && current.executor.selection.generation > 0) return current;
+          if (attempts > 1 && options.wait) return options.wait(500).then(function () { verified.state = "ready"; return readSelection(attempts - 1); });
+          throw fail("executor_selection_unconfirmed");
+        });
+      }
+      return readSelection(40);
+    }).then(function (result) { return removeExact().then(function () { return result; }); }, function (error) {
+      return removeExact().then(function () { throw error; });
+    });
+  }
+  // Why a status reply is not the approved, running executor; null when it is.
+  function mismatch(status) {
+    if (!status || status.ready !== true) return "the approved executor is not answering" + (status && (status.reason || status.state) ? " (" + (status.reason || status.state) + ")" : "") + ".";
+    if (!options.pins || status.executor_digest !== options.pins.executorDigest || status.policy_digest !== options.pins.policyDigest) return "the running executor reports other digests than this package pins.";
+    return null;
+  }
+  function pinned(status) { return mismatch(status) === null; }
+  function running(verified) {
+    return options.call("executor.status", {}).then(function (status) {
+      if (!pinned(status)) return null;
+      verified.executor = status; return verified;
+    }, function () { return null; });
+  }
+  // budget: how long to keep asking after a start (ms). The wait doubles from
+  // 500 ms to 2 s so an open window does not poll the executor twice a second.
+  function health(verified, budget, delay) {
     if (verified.state !== "ready") return Promise.resolve(verified);
+    delay = Math.min(delay || 500, 2000);
     return options.call("executor.status", {}).then(function (status) {
-      if (!status || status.ready !== true || !options.pins || status.executor_digest !== options.pins.executorDigest || status.policy_digest !== options.pins.policyDigest) throw fail("executor_status_mismatch");
+      var why = mismatch(status);
+      if (why) throw fail("executor_status_mismatch", why);
       verified.executor = status; return verified;
+    }, function (e) {
+      throw fail(e && e.code, "the executor status request failed.");
     }).catch(function (e) {
-      if (attempts > 1 && options.wait) return options.wait(500).then(function () { return health(verified, attempts - 1); });
-      verified.state = "blocked"; verified.reason = reason(e); return verified;
+      if (budget >= delay && options.wait) return options.wait(delay).then(function () { return health(verified, budget - delay, delay * 2); });
+      // The tasks are approved: approving again runs start, which restarts the
+      // executor without a password, so the panel offers it.
+      verified.state = "blocked"; verified.reason = reason(e); verified.retry = true; return verified;
     });
   }
   function start(verified) {
@@ -104,13 +212,17 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       return send(eventAPI, "run", 1, verified.tasks.boot.ref);
     }).then(function () {
       // run can succeed for a nonexistent task. Read both definitions again.
-      return read().then(function (after) { return health(after, 20); });
+      return read().then(function (after) { return health(after, 10000); });
     }).catch(function (e) { verified.state = "blocked"; verified.reason = reason(e); return verified; });
   }
+  // The window panel and the app's own settings share this access; each
+  // result reaches every view so neither shows a stale state.
+  var listeners = [];
+  function publish(result) { listeners.forEach(function (listener) { listener(result); }); return result; }
   return {
-    status: function () { return read().then(function (verified) { return health(verified, 1); }); },
-    authorize: function (password) {
-      if (!busy) busy = approve(password).catch(function (e) { return {state: "blocked", reason: reason(e), tasks: {}}; }).then(function (r) { busy = null; return r; });
+    status: function () { return read().then(function (verified) { return health(verified, 0); }).then(publish); },
+    authorize: function (password, selectedScope) {
+      if (!busy) busy = Promise.resolve().then(function () { return approve(password, selectedScope); }).catch(function (e) { return {state: "blocked", reason: reason(e), tasks: {}, retry: !!(e && e.passwordConfirm)}; }).then(function (r) { busy = null; return publish(r); });
       return busy;
     },
     control: function (action) {
@@ -119,9 +231,10 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
         if (verified.state !== "ready") throw fail("executor_not_ready");
         return options.call("executor.control", {action: action}).then(function () {
           return send(taskAPI, "run", 2, {tasks: [verified.tasks.control.ref]});
-        }).then(read).then(function (after) { return action === "start" ? health(after, 20) : after; });
-      });
-    }
+        }).then(read).then(function (after) { return action === "start" ? health(after, 10000) : after; });
+      }).then(publish);
+    },
+    subscribe: function (listener) { listeners.push(listener); }
   };
 }`;
 export const ROOT_PANEL = `function mountRootPanel(host, access, i18n, tasks, admin) {
@@ -129,9 +242,53 @@ export const ROOT_PANEL = `function mountRootPanel(host, access, i18n, tasks, ad
   var status = document.createElement("p"), approve = document.createElement("button"), retry = document.createElement("button");
   approve.textContent = "Approve background access"; retry.textContent = "Check status";
   host.appendChild(status); host.appendChild(approve); host.appendChild(retry);
-  function show(result) { status.textContent = result.state + (result.reason ? ": " + result.reason : ""); approve.hidden = result.state !== "needs-admin-approval"; }
+  function show(result) { status.textContent = result.state + (result.reason ? ": " + result.reason : ""); approve.hidden = result.state !== "needs-admin-approval" && result.retry !== true; }
   function run(fn) { approve.disabled = retry.disabled = true; return fn().then(show, function(e) { show({state: "blocked", reason: e.message || e.code}); }).then(function() { approve.disabled = retry.disabled = false; }); }
+  access.subscribe(show);
   approve.onclick = function() { return run(function() { return access.authorize(); }); };
   retry.onclick = function() { return run(function() { return access.status(); }); };
   run(function() { return access.status().then(function(result) { return result.tasks && result.tasks.boot && result.tasks.control && result.tasks.boot.state === "ready" && result.tasks.control.state === "ready" ? access.control("start") : result; }); });
 }`;
+/** Administrator password confirmation in the window's own session: a supplied
+ * password, or a masked form when none is given. */
+export const PASSWORD_CONFIRM = `function createPasswordConfirm(win) {
+  var versionUnsupported = ${versionUnsupported.toString()};
+  function send(password, version) {
+    return new Promise(function (resolve, reject) {
+      win.sendWebAPI({api: "SYNO.Core.User.PasswordConfirm", method: "auth", version: version, params: {password: password}, scope: win,
+        callback: function (success, response) {
+          if (!success) reject({code: "dsm_" + ((response && response.code) || "error")});
+          else resolve({confirmed: true, token: response && response.SynoConfirmPWToken});
+        }
+      });
+    });
+  }
+  // DSM 7.1 has PasswordConfirm v1 only, which checks the password but issues no
+  // token. Only an unsupported version is retried; a wrong password is not.
+  function auth(password) {
+    return send(password, 2).catch(function (error) {
+      if (!versionUnsupported(error.code)) throw error;
+      return send(password, 1);
+    });
+  }
+  return function (suppliedPassword) {
+    if (typeof suppliedPassword === "string" && suppliedPassword) return auth(suppliedPassword);
+    return new Promise(function (resolve, reject) {
+      var form = document.createElement("form"), label = document.createElement("label"), input = document.createElement("input");
+      var submit = document.createElement("button"), cancel = document.createElement("button");
+      label.textContent = "Confirm your DSM administrator password";
+      input.type = "password"; input.autocomplete = "current-password"; input.required = true;
+      label.appendChild(input); form.appendChild(label);
+      submit.type = "submit"; submit.textContent = "Approve"; form.appendChild(submit);
+      cancel.type = "button"; cancel.textContent = "Cancel"; form.appendChild(cancel);
+      win.body.dom.appendChild(form); input.focus();
+      function close() { input.value = ""; if (form.parentNode) form.parentNode.removeChild(form); }
+      cancel.onclick = function () { close(); resolve({confirmed: false}); };
+      form.onsubmit = function (event) {
+        event.preventDefault(); submit.disabled = cancel.disabled = true;
+        var password = input.value; input.value = "";
+        auth(password).then(function (result) { close(); resolve(result); }, function (error) { close(); reject(error); });
+      };
+    });
+  };
+}`;

package/dist/standalone/spk.d.ts

@@ -14,7 +14,7 @@ export interface AssembleOptions {
     outputPath: string;
     executor?: ExecutorArtifact;
     daemonControl?: string;
-    /** The compiled background worker, required exactly when the manifest declares background. */
+    /** The compiled background worker, required exactly when capabilities.jobs is enabled. */
     backgroundWorker?: string;
 }
 /**

package/dist/standalone/spk.js

@@ -1,3 +1,4 @@
+import { metadataInfoFields } from "../package-metadata.js";
 import { createHash } from "node:crypto";
 import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
 import { tmpdir } from "node:os";
@@ -8,6 +9,7 @@ import { renderNativePrivilege } from "../build-spk/native-lifecycle.js";
 import { renderUninstallWizardFiles } from "../build-spk/uninstall-wizard.js";
 import { renderInstallWizardFiles, renderNativeInstallWizard } from "../build-spk/install-wizard.js";
 import { writeWizardUiFiles } from "../build-spk/wizard-i18n.js";
+import { renderDelegateScopeSteps } from '../build-spk/delegate-scope.js';
 import { createReproducibleTar } from "../build-spk/reproducible-archive.js";
 import { renderStandaloneScript } from "./lifecycle.js";
 import { DSM_LANGS, LOCALES } from "./i18n.js";
@@ -17,7 +19,10 @@ import { hostScriptName, renderHostAdapterScript } from "./host-adapter.js";
 import { copyDaemonPayload } from "./daemon.js";
 import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit } from "./background.js";
 import { renderStandaloneResource } from "./resource.js";
+import { nativePortal } from "./portal.js";
+import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderPortalMustache, renderPortalWizardStep } from "../portal/package.js";
 import { executorPlan } from "../runtime/executor-build.js";
+import { EXECUTOR_ANCHOR } from "../runtime/executor-inspect.js";
 import { renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps } from "./shared-folder.js";
 const FILE_MODE = 0o644;
 const EXEC_MODE = 0o755;
@@ -77,6 +82,11 @@ export async function assembleStandaloneSpk(options) {
         copyStandaloneNotices(manifest.root, manifest.ui.dir, join(staging, 'package'), manifest.backend.kind === 'go' || Boolean(manifest.daemon), manifest.backend.kind === 'go' ? manifest.backend.dir : undefined);
         if (manifest.daemon)
             copyFileSync(new URL('../../templates/_shared/LICENSES/TEMPLATE.txt', import.meta.url), join(staging, 'package', 'LICENSES', 'DAEMON-LICENSE.txt'));
+        const portal = nativePortal(manifest);
+        if (portal) {
+            writeFile(join(staging, "package", PORTAL_JSON_RELPATH), renderPortalJson(portal));
+            writeFile(join(staging, "package", PORTAL_MUSTACHE_RELPATH), renderPortalMustache());
+        }
         if (options.executor) {
             const executorDir = join(staging, "package", "executor");
             mkdirSync(executorDir);
@@ -93,11 +103,11 @@ export async function assembleStandaloneSpk(options) {
         await createReproducibleTar(join(staging, "package"), packageTgz, { gzip: true });
         rmSync(join(staging, "package"), { recursive: true, force: true });
         const checksum = createHash("md5").update(readFileSync(packageTgz)).digest("hex");
-        writeFile(join(staging, "sdk-package.json"), JSON.stringify({ schema: 2, backend: manifest.backend.kind, capabilities: Object.keys(manifest.capabilities).sort() }));
-        writeFile(join(staging, "INFO"), renderInfo(manifest, options.arch, checksum));
+        writeFile(join(staging, "sdk-package.json"), JSON.stringify({ schema: 2, backend: manifest.backend.kind, capabilities: Object.keys(manifest.capabilities).sort(), ...(manifest.entry ? { entry: manifest.entry } : {}) }));
+        writeFile(join(staging, "INFO"), renderInfo(manifest, options.arch, checksum, options.executor?.executorDigest));
         mkdirSync(join(staging, "conf"));
         writeFile(join(staging, "conf", "privilege"), renderNativePrivilege());
-        const resource = renderStandaloneResource(manifest);
+        const resource = renderStandaloneResource(manifest, portal);
         if (resource)
             writeFile(join(staging, "conf", "resource"), resource);
         if (manifest.capabilities.jobs) {
@@ -109,7 +119,10 @@ export async function assembleStandaloneSpk(options) {
             writeFile(join(staging, "scripts", name), renderStandaloneScript(name, manifest), EXEC_MODE);
         }
         const folder = manifest.sharedFolder;
-        const install = renderInstallWizardFiles(manifest.package, folder ? sharedFolderInstallSteps(manifest.package, folder) : renderNativeInstallWizard);
+        const steps = manifest.capabilities.delegate?.scope === 'install-selected'
+            ? (t) => [...renderDelegateScopeSteps(t), ...(folder ? sharedFolderInstallSteps(manifest.package, folder)(t) : [])]
+            : folder ? sharedFolderInstallSteps(manifest.package, folder) : renderNativeInstallWizard;
+        const install = renderInstallWizardFiles(manifest.package, portal ? (t) => [...steps(t), renderPortalWizardStep(t, portal.alias)] : steps);
         writeWizardUiFiles(staging, {
             ...install.static,
             ...install.dynamic,
@@ -130,10 +143,10 @@ function writeFile(path, content, mode = FILE_MODE) {
     chmodSync(path, mode);
 }
 function quote(value) {
-    return `"${value}"`;
+    return `"${value.replace(/([\\"$`])/g, "\\$1")}"`;
 }
 /** Manifest validation already refused quotes, backslashes and newlines. */
-function renderInfo(manifest, arch, checksum) {
+function renderInfo(manifest, arch, checksum, executorDigest) {
     const fields = [
         ["package", manifest.package],
         ["version", manifest.spkVersion],
@@ -148,7 +161,12 @@ function renderInfo(manifest, arch, checksum) {
         ["startable", "yes"],
         ["checksum", checksum],
     ];
-    if (manifest.daemon)
+    // Package Center writes INFO as root; root tasks accept only this executor.
+    if (executorDigest)
+        fields.push([EXECUTOR_ANCHOR, executorDigest]);
+    fields.push(...metadataInfoFields(manifest.metadata));
+    // Background packages need prestart: it runs before DSM's systemd-user-unit acquire.
+    if (manifest.daemon || manifest.capabilities.jobs)
         fields.push(["precheckstartstop", "yes"]);
     for (const locale of LOCALES) {
         const text = manifest.i18n?.info[locale];

package/dist/templates/_daemon/go.mod

@@ -2,4 +2,4 @@ module synopkgland-daemon
 
 go 1.24
 
-toolchain go1.26.8
+toolchain go1.26.9

package/dist/templates/_daemon/main.go

@@ -28,6 +28,9 @@ type deadlines struct {
 	Start  int `json:"start"`
 	Stop   int `json:"stop"`
 	Status int `json:"status"`
+	// Uninstall bounds uninstall_args separately from Stop: a revoke on a
+	// loaded NAS can take longer than stopping the daemon.
+	Uninstall int `json:"uninstall"`
 }
 type config struct {
 	Package       string            `json:"package"`
@@ -88,7 +91,7 @@ func load(dest, data string) (*controller, error) {
 	if cfg.Exec == "" || filepath.IsAbs(cfg.Exec) || filepath.Clean(cfg.Exec) != cfg.Exec || strings.HasPrefix(cfg.Exec, "../") {
 		return nil, errors.New("invalid fixed executable")
 	}
-	if cfg.Timeouts.Start < 2 || cfg.Timeouts.Start > 120 || cfg.Timeouts.Stop < 2 || cfg.Timeouts.Stop > 120 || cfg.Timeouts.Status < 1 || cfg.Timeouts.Status > 10 {
+	if cfg.Timeouts.Start < 2 || cfg.Timeouts.Start > 120 || cfg.Timeouts.Stop < 2 || cfg.Timeouts.Stop > 120 || cfg.Timeouts.Status < 1 || cfg.Timeouts.Status > 10 || cfg.Timeouts.Uninstall < 2 || cfg.Timeouts.Uninstall > 120 {
 		return nil, errors.New("invalid daemon deadlines")
 	}
 	hash := sha256.Sum256(raw)
@@ -162,7 +165,7 @@ func (c *controller) run(action string) (int, error) {
 		budget += c.Timeouts.Start
 	}
 	if action == "uninstall" {
-		budget += c.Timeouts.Stop + 1
+		budget += c.Timeouts.Uninstall + 2
 	}
 	if action != "start" && action != "stop" && action != "status" && action != "restart" && action != "uninstall" {
 		return 1, errors.New("unsupported daemon action")
@@ -414,7 +417,7 @@ func (c *controller) uninstall() error {
 	select {
 	case err := <-done:
 		return err
-	case <-time.After(time.Duration(c.Timeouts.Stop-1) * time.Second):
+	case <-time.After(time.Duration(c.Timeouts.Uninstall) * time.Second):
 		cmd.Process.Signal(syscall.SIGTERM)
 	}
 	select {

package/dist/templates/_daemon/main_test.go

@@ -41,10 +41,16 @@ func fixture(t *testing.T, mode string) (string, string, string) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(dest, "daemon/payload/app"), raw, 0755); err != nil {
+	app := filepath.Join(dest, "daemon/payload/app")
+	if err := os.WriteFile(app, raw, 0755); err != nil {
 		t.Fatal(err)
 	}
-	cfg := config{Package: "DaemonFixture", Exec: "app", Args: []string{"${SYNOPKG_PKGVAR}/a space", "$(touch BAD)'", "${SYNOPKG_PKGDEST}"}, Env: map[string]string{"APP_MODE": mode}, Timeouts: deadlines{Start: 2, Stop: 2, Status: 1}}
+	// macOS verifies a newly written executable on its first exec, which takes
+	// seconds on a loaded host; pay it here, not inside a one-second budget.
+	if raw, err := exec.Command(app, "cleanup").CombinedOutput(); err != nil {
+		t.Fatalf("payload warm-up: %v %s", err, raw)
+	}
+	cfg := config{Package: "DaemonFixture", Exec: "app", Args: []string{"${SYNOPKG_PKGVAR}/a space", "$(touch BAD)'", "${SYNOPKG_PKGDEST}"}, Env: map[string]string{"APP_MODE": mode}, Timeouts: deadlines{Start: 2, Stop: 2, Status: 1, Uninstall: 2}}
 	if os.Geteuid() == 0 {
 		cfg.Package = "nobody"
 	} else {
@@ -91,22 +97,69 @@ func runControl(control, action, dest, data string) (int, string) {
 	return -1, err.Error()
 }
 
+// Readiness only proves the child stayed alive for a second, not that it reached
+// main: on a loaded host a stop can kill it before it writes its line. Spawn
+// identity therefore comes from the inventory, and log content is awaited.
+func recordedChild(t *testing.T, data string) int {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join(data, "daemon/daemon.pid"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var r record
+	if err := json.Unmarshal(raw, &r); err != nil || r.Child < 1 {
+		t.Fatalf("daemon inventory: %v %s", err, raw)
+	}
+	return r.Child
+}
+
+func awaitChildLines(t *testing.T, data string, want int) {
+	t.Helper()
+	path := filepath.Join(data, "daemon/daemon.log")
+	for deadline := time.Now().Add(10 * time.Second); ; time.Sleep(20 * time.Millisecond) {
+		raw, _ := os.ReadFile(path)
+		if got := strings.Count(string(raw), `"uid":`); got >= want || time.Now().After(deadline) {
+			if got != want {
+				t.Fatalf("child lines=%d want=%d: %s", got, want, raw)
+			}
+			return
+		}
+	}
+}
+
 func TestDaemonLifecycle(t *testing.T) {
 	control, dest, data := fixture(t, "normal")
-	for _, step := range []struct {
-		action string
-		want   int
-	}{{"status", 3}, {"stop", 0}, {"start", 0}, {"status", 0}, {"start", 0}, {"restart", 0}, {"stop", 0}, {"stop", 0}, {"status", 3}, {"unknown", 1}} {
-		if rc, out := runControl(control, step.action, dest, data); rc != step.want {
-			t.Fatalf("%s rc=%d want=%d: %s", step.action, rc, step.want, out)
+	step := func(action string, want int) {
+		t.Helper()
+		if rc, out := runControl(control, action, dest, data); rc != want {
+			t.Fatalf("%s rc=%d want=%d: %s", action, rc, want, out)
 		}
 	}
+	step("status", 3)
+	step("stop", 0)
+	step("start", 0)
+	awaitChildLines(t, data, 1)
+	first := recordedChild(t, data)
+	step("status", 0)
+	step("start", 0)
+	if child := recordedChild(t, data); child != first {
+		t.Fatalf("duplicate start spawned another child: %d replaced %d", child, first)
+	}
+	step("restart", 0)
+	if child := recordedChild(t, data); child == first {
+		t.Fatalf("restart kept child %d", child)
+	}
+	awaitChildLines(t, data, 2)
+	step("stop", 0)
+	step("stop", 0)
+	step("status", 3)
+	step("unknown", 1)
 	raw, err := os.ReadFile(filepath.Join(data, "daemon/daemon.log"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	if strings.Count(string(raw), `"uid":`) != 2 {
-		t.Fatalf("duplicate start spawned another child: %s", raw)
+		t.Fatalf("unexpected child spawn: %s", raw)
 	}
 	if strings.Contains(string(raw), "must-not-leak") {
 		t.Fatalf("ambient environment leaked: %s", raw)
@@ -197,6 +250,26 @@ func TestUninstallCleanup(t *testing.T) {
 	}
 }
 
+// A revoke on uninstall can outlast the stop deadline on a loaded NAS; it has
+// its own budget instead of Stop-1.
+func TestUninstallCommandHasItsOwnBudget(t *testing.T) {
+	control, dest, data := fixture(t, "normal")
+	path := filepath.Join(dest, "daemon/config.json")
+	raw, _ := os.ReadFile(path)
+	var cfg config
+	json.Unmarshal(raw, &cfg)
+	cfg.UninstallArgs = []string{"cleanup-slow"}
+	cfg.Timeouts.Uninstall = 5
+	raw, _ = json.Marshal(cfg)
+	os.WriteFile(path, raw, 0644)
+	if rc, out := runControl(control, "start", dest, data); rc != 0 {
+		t.Fatalf("start: %d %s", rc, out)
+	}
+	if rc, out := runControl(control, "uninstall", dest, data); rc != 0 {
+		t.Fatalf("slow uninstall within its budget failed: %d %s", rc, out)
+	}
+}
+
 func TestPackageAccountIdentity(t *testing.T) {
 	control, dest, data := fixture(t, "normal")
 	path := filepath.Join(dest, "daemon/config.json")

package/dist/templates/_daemon/testdata/child.go

@@ -14,6 +14,9 @@ func main() {
 		switch os.Args[1] {
 		case "cleanup":
 			os.Exit(0)
+		case "cleanup-slow":
+			time.Sleep(2500 * time.Millisecond)
+			os.Exit(0)
 		case "cleanup-fail":
 			os.Exit(2)
 		case "cleanup-hang":