@synopackageland/cli 0.6.1 → 0.7.1

package/dist/templates/_executor/selected_scope_test.go

@@ -0,0 +1,186 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func selectedExecutor(t *testing.T) (*Executor, *fakeDSM) {
+	e, f, _ := setup(t)
+	e.Policy.Scope = installSelectedScope
+	e.Policy.Lifetime = "until-revoked"
+	e.Policy.Destinations = []string{"save"}
+	f.user.Admin = true
+	return e, f
+}
+func selectScope(e *Executor, scope string, peer int) Response {
+	state, _ := e.Store.SelectedScope()
+	b, _ := json.Marshal(map[string]any{"scope": scope, "actor": "alice", "expected_generation": state.Generation})
+	return e.handlePeer(context.Background(), Request{Version: 1, Op: "delegate.setScope", Params: b}, peer, 3000)
+}
+func selectedGrant(t *testing.T, e *Executor, path string) Delegation {
+	t.Helper()
+	r := request(e, "delegate.create", map[string]any{"scope": installSelectedScope, "ops": []string{"files.moveFromStaging"}, "path": path, "destination": "save", "lifetime": "until-revoked"})
+	if !r.OK {
+		t.Fatal(r)
+	}
+	b, _ := json.Marshal(r.Result)
+	var d Delegation
+	json.Unmarshal(b, &d)
+	return d
+}
+func TestSelectedScopeOnlyPasswordConfirmedRootPeerMayChange(t *testing.T) {
+	e, f := selectedExecutor(t)
+	if r := selectScope(e, "shared:reports", 3000); r.OK {
+		t.Fatal("package changed scope", r)
+	}
+	if r := selectScope(e, "shared:reports", 3001); r.OK {
+		t.Fatal("other peer changed scope", r)
+	}
+	f.user.Admin = false
+	if r := selectScope(e, "shared:reports", 0); r.OK {
+		t.Fatal("nonadministrator actor", r)
+	}
+	f.user.Admin = true
+	for _, params := range []string{`{"scope":"home","actor":"alice"}`, `{"scope":"home","actor":"alice","expected_generation":null}`, `{"scope":"home","actor":"alice","expected_generation":9007199254740992}`} {
+		if r := e.handlePeer(context.Background(), Request{Version: 1, Op: "delegate.setScope", Params: json.RawMessage(params)}, 0, 3000); r.OK {
+			t.Fatal("unbound root task accepted", r)
+		}
+	}
+	for _, scope := range []string{"*", "shared:../escape", "shared:homes", "shared:home", "shared:", "home\n", "shared:a:b"} {
+		if r := selectScope(e, scope, 0); r.OK {
+			t.Fatal(scope, r)
+		}
+	}
+	if r := selectScope(e, "shared:reports", 0); !r.OK {
+		t.Fatal(r)
+	}
+	state, err := e.Store.SelectedScope()
+	if err != nil || state.Scope != "shared:reports" || state.Generation != 1 {
+		t.Fatal(state, err)
+	}
+	info, _ := os.Stat(filepath.Join(e.Store.Dir, "selected-scope.record"))
+	if info.Mode().Perm() != 0600 {
+		t.Fatal(info.Mode())
+	}
+	// No admin cookie/SynoToken can turn the ordinary package socket into root authority.
+	if r := request(e, "delegate.setScope", map[string]string{"scope": "home"}); r.OK {
+		t.Fatal(r)
+	}
+}
+func TestSelectedScopeMissingCorruptAndChangeBackFailClosed(t *testing.T) {
+	e, _ := selectedExecutor(t)
+	p := map[string]any{"scope": installSelectedScope, "ops": []string{"files.moveFromStaging"}, "path": "/home", "destination": "save", "lifetime": "until-revoked"}
+	if r := request(e, "delegate.create", p); r.OK {
+		t.Fatal("unconfirmed scope", r)
+	}
+	if r := selectScope(e, "home", 0); !r.OK {
+		t.Fatal(r)
+	}
+	d := selectedGrant(t, e, "/home")
+	if d.Scope != "home" || d.ScopeGeneration != 1 {
+		t.Fatal(d)
+	}
+	if r := selectScope(e, "home", 0); !r.OK {
+		t.Fatal(r)
+	}
+	state, _ := e.Store.SelectedScope()
+	if state.Generation != 1 {
+		t.Fatal("unchanged scope invalidates", state)
+	}
+	if r := selectScope(e, "shared:reports", 0); !r.OK {
+		t.Fatal(r)
+	}
+	if r := request(e, "delegate.create", p); r.Code != "SCOPE_DENIED" {
+		t.Fatal("outside chosen share", r)
+	}
+	if r := selectScope(e, "home", 0); !r.OK {
+		t.Fatal(r)
+	}
+	if _, code := e.validateMove(context.Background(), d); code == "" {
+		t.Fatal("change-back revived old grant")
+	}
+	fresh := &Executor{Policy: e.Policy, DSM: e.DSM, Store: &Store{Dir: e.Store.Dir}, Now: e.Now}
+	if _, code := fresh.validateMove(context.Background(), d); code == "" {
+		t.Fatal("restart revived old grant")
+	}
+	d = selectedGrant(t, e, "/home")
+	if d.ScopeGeneration != 3 {
+		t.Fatal(d)
+	}
+	os.WriteFile(filepath.Join(e.Store.Dir, "selected-scope.record"), []byte(`{"schema":1,"scope":"home","generation":0}`), 0600)
+	if r := request(e, "delegate.create", p); r.OK {
+		t.Fatal("corrupt scope allowed", r)
+	}
+	if _, code := e.validateMove(context.Background(), d); code == "" {
+		t.Fatal("corrupt state allowed move")
+	}
+}
+func TestSelectedScopeChangeFencesActivePublish(t *testing.T) {
+	e, _ := selectedExecutor(t)
+	if r := selectScope(e, "home", 0); !r.OK {
+		t.Fatal(r)
+	}
+	d := selectedGrant(t, e, "/home")
+	w := &barrierMoveWriter{copying: make(chan struct{}), release: make(chan struct{}), published: make(chan struct{})}
+	e.Writer = w
+	if err := e.startOperations(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	defer e.stopOperations()
+	if r := offline(e, "files.moveFromStaging", moveParams(d.ID, "scope-race")); !r.OK {
+		t.Fatal(r)
+	}
+	<-w.copying
+	if r := selectScope(e, "shared:reports", 0); !r.OK {
+		t.Fatal(r)
+	}
+	close(w.release)
+	if op := waitState(t, e, "scope-race", "canceled"); op.Reason != "scope-changed" {
+		t.Fatal("missing scope cancellation reason", op)
+	}
+	select {
+	case <-w.published:
+		t.Fatal("published after scope change acknowledgement")
+	default:
+	}
+}
+
+func TestSelectedDestinationReplacesOnlyThisOwnerAndKey(t *testing.T) {
+	e, _ := selectedExecutor(t)
+	if r := selectScope(e, "home", 0); !r.OK {
+		t.Fatal(r)
+	}
+	old := selectedGrant(t, e, "/home")
+	fresh := selectedGrant(t, e, "/home")
+	prior, err := e.Store.Get(old.ID)
+	if err != nil || !prior.Revoked {
+		t.Fatal("prior destination still active", prior, err)
+	}
+	current, err := e.Store.Get(fresh.ID)
+	if err != nil || current.Revoked {
+		t.Fatal(current, err)
+	}
+}
+
+func TestSelectedScopeTaskCannotReplayAfterAnotherConfirmation(t *testing.T) {
+	e, _ := selectedExecutor(t)
+	b, _ := json.Marshal(map[string]any{"scope": "home", "actor": "alice", "expected_generation": uint64(0)})
+	old := Request{Version: 1, Op: "delegate.setScope", Params: b}
+	if r := e.handlePeer(context.Background(), old, 0, 3000); !r.OK {
+		t.Fatal(r)
+	}
+	if r := selectScope(e, "shared:reports", 0); !r.OK {
+		t.Fatal(r)
+	}
+	if r := e.handlePeer(context.Background(), old, 0, 3000); r.Code != "SCOPE_APPROVAL_STALE" {
+		t.Fatal("old root task widened the newly confirmed scope", r)
+	}
+	state, err := e.Store.SelectedScope()
+	if err != nil || state.Scope != "shared:reports" || state.Generation != 2 {
+		t.Fatal(state, err)
+	}
+}

package/dist/templates/_executor/status_disabled_test.go

@@ -0,0 +1,33 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestStatusReadsProtectedDisabledAndRefusesStoreError(t *testing.T) {
+	e, _, _ := setup(t)
+	check := func(ready, disabled bool) {
+		t.Helper()
+		r := request(e, "status", map[string]any{})
+		b, _ := json.Marshal(r.Result)
+		var out struct {
+			Ready    bool  `json:"ready"`
+			Disabled *bool `json:"disabled"`
+		}
+		if !r.OK || json.Unmarshal(b, &out) != nil || out.Ready != ready || out.Disabled == nil || *out.Disabled != disabled {
+			t.Fatalf("status: %s", b)
+		}
+	}
+	check(true, false)
+	if err := e.Store.SetDisabled(true); err != nil {
+		t.Fatal(err)
+	}
+	check(true, true)
+	if err := os.WriteFile(filepath.Join(e.Store.Dir, "disabled.record"), []byte("broken"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	check(false, false)
+}

package/dist/templates/_executor/store.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strings"
 )
 
 // Dir and its ancestors are validated root-owned at service startup. No client
@@ -16,8 +17,8 @@ func (s *Store) Put(d Delegation) error {
 		return errors.New("id")
 	}
 	b, err := json.Marshal(d)
-	if err != nil {
-		return err
+	if err != nil || len(b) > maxRequest {
+		return errors.New("grant size")
 	}
 	f, err := os.CreateTemp(s.Dir, ".delegation-")
 	if err != nil {
@@ -77,7 +78,7 @@ func (s *Store) List() ([]Delegation, error) {
 	}
 	ds := []Delegation{}
 	for _, ent := range entries {
-		if filepath.Ext(ent.Name()) != ".json" {
+		if filepath.Ext(ent.Name()) != ".json" || !idRE.MatchString(strings.TrimSuffix(ent.Name(), ".json")) {
 			continue
 		}
 		d, err := s.Get(ent.Name()[:len(ent.Name())-5])

package/dist/templates/_executor/supervise.go

@@ -0,0 +1,109 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"os/signal"
+	"syscall"
+	"time"
+)
+
+// serve exits with this status when another monitor holds executor.pid; the
+// flock, not the supervisor, decides which monitor survives.
+const exitAlreadyRunning = 3
+
+var errAlreadyRunning = errors.New("already running")
+
+func exitStatus(err error) int {
+	if errors.Is(err, errAlreadyRunning) {
+		return exitAlreadyRunning
+	}
+	return 1
+}
+
+const (
+	minRestartDelay = time.Second
+	maxRestartDelay = time.Minute
+	stableServeRun  = time.Minute
+)
+
+// supervise reruns the approved serve after an abnormal end. A clean exit
+// (root replacement, shutdown or purge), another live monitor, termination of
+// the supervisor or a purged runtime all end supervision instead.
+func supervise(ctx context.Context, run func(ctx context.Context, revived bool) error, runtimePresent func() bool, sleep func(context.Context, time.Duration) bool, now func() time.Time, log func(string)) error {
+	delay := minRestartDelay
+	revived := false
+	for {
+		started := now()
+		err := run(ctx, revived)
+		if err == nil || ctx.Err() != nil {
+			return nil
+		}
+		var exit *exec.ExitError
+		if errors.As(err, &exit) && exit.ExitCode() == exitAlreadyRunning {
+			log("executor supervisor: another monitor is running")
+			return nil
+		}
+		if now().Sub(started) >= stableServeRun {
+			delay = minRestartDelay
+		}
+		if !runtimePresent() {
+			log("executor supervisor: runtime removed")
+			return nil
+		}
+		log(fmt.Sprintf("executor supervisor: serve ended (%v); restarting in %s", err, delay))
+		if !sleep(ctx, delay) || !runtimePresent() {
+			return nil
+		}
+		delay = min(2*delay, maxRestartDelay)
+		revived = true
+	}
+}
+
+func serveArgs(pkg string, revived bool) []string {
+	args := []string{"serve", "--package", pkg}
+	if revived {
+		args = append(args, "--revived")
+	}
+	return args
+}
+
+// Root control start launches the supervisor in its own session; serve runs as
+// its child and still owns executor.pid for root stop/purge/replacement.
+func supervisorCommand(exe, pkg string) *exec.Cmd {
+	cmd := exec.Command(exe, "supervise", "--package", pkg)
+	cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"}
+	cmd.Dir = "/"
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
+	return cmd
+}
+
+func runSupervisor(exe, pkg string) error {
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
+	defer stop()
+	run := func(ctx context.Context, revived bool) error {
+		cmd := exec.CommandContext(ctx, exe, serveArgs(pkg, revived)...)
+		cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"}
+		cmd.Dir = "/"
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		cmd.Cancel = func() error { return cmd.Process.Signal(syscall.SIGTERM) }
+		return cmd.Run()
+	}
+	present := func() bool { _, err := os.Lstat(exe); return err == nil }
+	sleep := func(ctx context.Context, d time.Duration) bool {
+		t := time.NewTimer(d)
+		defer t.Stop()
+		select {
+		case <-ctx.Done():
+			return false
+		case <-t.C:
+			return true
+		}
+	}
+	return supervise(ctx, run, present, sleep, time.Now, func(s string) { log.Print(s) })
+}

package/dist/templates/_executor/supervise_test.go

@@ -0,0 +1,130 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"reflect"
+	"testing"
+	"time"
+)
+
+type superviseFixture struct {
+	scripts []string
+	revived []bool
+	delays  []time.Duration
+	present bool
+	clock   time.Time
+	runFor  []time.Duration
+}
+
+// Each run executes a real child so exit status and signal death come from the
+// kernel, exactly as the supervisor sees serve.
+func (f *superviseFixture) run(ctx context.Context, revived bool) error {
+	i := len(f.revived)
+	f.revived = append(f.revived, revived)
+	if i < len(f.runFor) {
+		f.clock = f.clock.Add(f.runFor[i])
+	}
+	script := "exit 0"
+	if i < len(f.scripts) {
+		script = f.scripts[i]
+	}
+	return exec.CommandContext(ctx, "/bin/sh", "-c", script).Run()
+}
+func (f *superviseFixture) sleep(_ context.Context, d time.Duration) bool {
+	f.delays = append(f.delays, d)
+	return true
+}
+func (f *superviseFixture) supervise(ctx context.Context) error {
+	return supervise(ctx, f.run, func() bool { return f.present }, f.sleep, func() time.Time { return f.clock }, func(string) {})
+}
+
+func TestSuperviseRestartsAbnormalServeUntilCleanExit(t *testing.T) {
+	f := &superviseFixture{present: true, scripts: []string{"kill -KILL $$", "exit 1", "exit 0"}}
+	if err := f.supervise(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if want := []bool{false, true, true}; !reflect.DeepEqual(f.revived, want) {
+		t.Fatalf("revived %v, want %v", f.revived, want)
+	}
+	if want := []time.Duration{time.Second, 2 * time.Second}; !reflect.DeepEqual(f.delays, want) {
+		t.Fatalf("delays %v, want %v", f.delays, want)
+	}
+}
+
+func TestSuperviseLeavesWhenAnotherMonitorOwnsThePidfile(t *testing.T) {
+	f := &superviseFixture{present: true, scripts: []string{"exit 3", "exit 0"}}
+	if err := f.supervise(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if len(f.revived) != 1 || len(f.delays) != 0 {
+		t.Fatalf("runs %v delays %v", f.revived, f.delays)
+	}
+}
+
+func TestSuperviseStopsOnceRuntimeIsPurged(t *testing.T) {
+	f := &superviseFixture{present: false, scripts: []string{"kill -KILL $$", "exit 0"}}
+	if err := f.supervise(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if len(f.revived) != 1 || len(f.delays) != 0 {
+		t.Fatalf("runs %v delays %v", f.revived, f.delays)
+	}
+}
+
+func TestSuperviseBacksOffToCapAndResetsAfterStableRun(t *testing.T) {
+	scripts := make([]string, 10)
+	for i := range scripts {
+		scripts[i] = "exit 2"
+	}
+	scripts = append(scripts, "exit 0")
+	runFor := make([]time.Duration, len(scripts))
+	runFor[8] = time.Minute
+	f := &superviseFixture{present: true, scripts: scripts, runFor: runFor}
+	if err := f.supervise(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	s := time.Second
+	want := []time.Duration{s, 2 * s, 4 * s, 8 * s, 16 * s, 32 * s, 60 * s, 60 * s, s, 2 * s}
+	if !reflect.DeepEqual(f.delays, want) {
+		t.Fatalf("delays %v, want %v", f.delays, want)
+	}
+}
+
+func TestSuperviseTerminationEndsWithoutRestart(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	f := &superviseFixture{present: true, scripts: []string{"sleep 30", "exit 0"}}
+	time.AfterFunc(100*time.Millisecond, cancel)
+	if err := f.supervise(ctx); err != nil {
+		t.Fatal(err)
+	}
+	if len(f.revived) != 1 || len(f.delays) != 0 {
+		t.Fatalf("runs %v delays %v", f.revived, f.delays)
+	}
+}
+
+func TestRootStartLaunchesSupervisorThatRevivesServe(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("checks the non-root refusal")
+	}
+	if err := run([]string{"supervise", "--package", "TestApp"}); err == nil || err.Error() != "root required" {
+		t.Fatalf("supervise mode: %v", err)
+	}
+	if err := run([]string{"control", "start", "--package", "TestApp", "--revived"}); err == nil || err.Error() != "unexpected revive" {
+		t.Fatalf("revive outside serve: %v", err)
+	}
+	if got := supervisorCommand("/x/runtime/executor", "TestApp").Args; !reflect.DeepEqual(got, []string{"/x/runtime/executor", "supervise", "--package", "TestApp"}) {
+		t.Fatal(got)
+	}
+	for revived, want := range map[bool][]string{false: {"serve", "--package", "TestApp"}, true: {"serve", "--package", "TestApp", "--revived"}} {
+		if got := serveArgs("TestApp", revived); !reflect.DeepEqual(got, want) {
+			t.Fatal(got)
+		}
+	}
+	if exitStatus(fmt.Errorf("serve: %w", errAlreadyRunning)) != exitAlreadyRunning || exitStatus(errors.New("other")) != 1 {
+		t.Fatal("exit status")
+	}
+}

package/dist/templates/_executor/task_race_review_test.go

@@ -24,7 +24,7 @@ func (s *reviewEditDuringDelete) Exec(ctx context.Context, path string, args []s
 }
 func TestReviewPurgeAcceptedAdminRaceLogsRemainingTasksWithoutRetry(t *testing.T) {
 	cmd := &reviewEditDuringDelete{}
-	inv := taskInventory{Package: "TestApp", ExecutorDigest: strings.Repeat("a", 64), PolicyDigest: strings.Repeat("b", 64), Tasks: []approvedTask{{Kind: "boot", Name: "TestApp executor boot", ScriptDigest: canonicalTaskDigest(t, "boot")}, {Kind: "control", Name: "TestApp executor control", ScriptDigest: canonicalTaskDigest(t, "control")}}}
+	inv := taskInventory{Package: "TestApp", PolicyDigest: strings.Repeat("b", 64), Tasks: []approvedTask{{Kind: "boot", Name: "TestApp executor boot", ScriptDigest: canonicalTaskDigest(t, "boot")}, {Kind: "control", Name: "TestApp executor control", ScriptDigest: canonicalTaskDigest(t, "control")}}}
 	logs := []string{}
 	purgeTasks(context.Background(), &liveDSM{Command: cmd}, "TestApp", inv, func(s string) { logs = append(logs, s) })
 	if len(cmd.deleted) != 1 {

package/dist/templates/_executor/tasks.go

@@ -6,10 +6,12 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
 	"synopkgland/executor/internal/taskscript"
+	"time"
 )
 
 type approvedTask struct {
@@ -18,15 +20,14 @@ type approvedTask struct {
 	ScriptDigest string `json:"script_digest"`
 }
 type taskInventory struct {
-	Package        string         `json:"package"`
-	ExecutorDigest string         `json:"executor_digest"`
-	PolicyDigest   string         `json:"policy_digest"`
-	Tasks          []approvedTask `json:"tasks"`
+	Package      string         `json:"package"`
+	PolicyDigest string         `json:"policy_digest"`
+	Tasks        []approvedTask `json:"tasks"`
 }
 
 func hashBytes(b []byte) string { h := sha256.Sum256(b); return hex.EncodeToString(h[:]) }
 func validInventory(pkg string, inventory taskInventory) bool {
-	if inventory.Package != pkg || len(inventory.Tasks) != 2 || !idRE.MatchString(inventory.ExecutorDigest) || !idRE.MatchString(inventory.PolicyDigest) {
+	if inventory.Package != pkg || len(inventory.Tasks) != 2 || !idRE.MatchString(inventory.PolicyDigest) {
 		return false
 	}
 	seen := map[string]bool{}
@@ -52,8 +53,7 @@ func taskReference(ctx context.Context, d *liveDSM, task approvedTask, expected
 	boot := task.Kind == "boot"
 	if !boot {
 		api = "SYNO.Core.TaskScheduler"
-		version = "4"
-		b, err := d.call(ctx, api, "list", "3", "", map[string]any{"start": 0, "limit": 500})
+		b, err := listControlTasks(ctx, d)
 		if err != nil {
 			return "", "", nil, err
 		}
@@ -84,7 +84,14 @@ func taskReference(ctx context.Context, d *liveDSM, task approvedTask, expected
 		}
 		ref = map[string]any{"id": id, "real_owner": "root"}
 	}
-	b, err := d.call(ctx, api, "get", version, "", ref)
+	var b json.RawMessage
+	var err error
+	if boot {
+		b, err = d.call(ctx, api, "get", version, "", ref)
+	} else {
+		b, err = onUnsupportedVersion(func() (json.RawMessage, error) { return d.call(ctx, api, "get", "4", "", ref) },
+			func() (json.RawMessage, error) { return d.call(ctx, api, "get", "3", "", ref) })
+	}
 	if err != nil {
 		return "", "", nil, err
 	}
@@ -150,11 +157,11 @@ func snapshotTasks(ctx context.Context, d *liveDSM, pkg, ed, pd, setupPath, runt
 	if strictJSON(b, &setup) != nil || setup.Package != pkg || setup.ExecutorDigest != ed || setup.PolicyDigest != pd || setup.Implementation != "executor" {
 		return errors.New("setup pins")
 	}
-	generated, err := taskscript.Generate(pkg, ed, pd)
+	generated, err := taskscript.Generate(pkg, pd)
 	if err != nil || len(setup.Tasks) != len(generated) {
 		return errors.New("setup task inventory")
 	}
-	inv := taskInventory{Package: pkg, ExecutorDigest: ed, PolicyDigest: pd}
+	inv := taskInventory{Package: pkg, PolicyDigest: pd}
 	for i, task := range generated {
 		hint := setup.Tasks[i]
 		if hint.Kind != task.Kind || hint.Name != task.Name || hint.Header != task.Header || hint.Script != task.Script {
@@ -214,7 +221,7 @@ func purgeTasks(ctx context.Context, d *liveDSM, pkg string, inv taskInventory,
 		log("task cleanup skipped: invalid protected inventory")
 		return
 	}
-	generated, err := taskscript.Generate(pkg, inv.ExecutorDigest, inv.PolicyDigest)
+	generated, err := taskscript.Generate(pkg, inv.PolicyDigest)
 	if err != nil {
 		log("task cleanup skipped: invalid protected pins")
 		return
@@ -226,20 +233,24 @@ func purgeTasks(ctx context.Context, d *liveDSM, pkg string, inv taskInventory,
 				expected = canonical.Script
 			}
 		}
+		started := time.Now()
 		api, version, ref, err := taskReference(ctx, d, task, expected)
 		if err != nil {
 			log("task cleanup skipped: " + task.Kind + " definition mismatch or unavailable")
 			continue
 		}
-		if _, err = d.call(ctx, api, "delete", version, "", ref); err != nil {
+		looked := time.Now()
+		if err = d.mutate(ctx, api, "delete", version, ref); err != nil {
 			log("task cleanup unconfirmed: " + task.Kind)
 		}
+		deleted := time.Now()
 		// The scheduler has no conditional delete. Accept the admin edit window,
 		// delete exactly once, and observe the name afterward without another delete.
 		if taskRemains(ctx, d, task) {
 			log("task cleanup: " + task.Kind + " same-named task remains after delete")
 		}
-
+		log(fmt.Sprintf("task cleanup timing: package=%s kind=%s lookup_ms=%d delete_ms=%d verify_ms=%d", pkg, task.Kind,
+			looked.Sub(started).Milliseconds(), deleted.Sub(looked).Milliseconds(), time.Since(deleted).Milliseconds()))
 	}
 }
 
@@ -247,8 +258,12 @@ func purgeWithInventory(ctx context.Context, d *liveDSM, pkg string, inv taskInv
 	if runtime != filepath.Join(state, "runtime") {
 		return errors.New("runtime outside package protected state")
 	}
+	started := time.Now()
 	purgeTasks(ctx, d, pkg, inv, log)
-	return finishControl(state, runtime, socket, true)
+	cleaned := time.Now()
+	err := finishControl(state, runtime, socket, true)
+	log(fmt.Sprintf("purge timing: package=%s tasks_ms=%d files_ms=%d", pkg, cleaned.Sub(started).Milliseconds(), time.Since(cleaned).Milliseconds()))
+	return err
 }
 
 func taskRemains(ctx context.Context, d *liveDSM, task approvedTask) bool {
@@ -262,7 +277,7 @@ func taskRemains(ctx context.Context, d *liveDSM, task approvedTask) bool {
 		}
 		return json.Unmarshal(b, &got) == nil && got.Name == task.Name
 	}
-	b, err := d.call(ctx, "SYNO.Core.TaskScheduler", "list", "3", "", map[string]any{"start": 0, "limit": 500})
+	b, err := listControlTasks(ctx, d)
 	if err != nil {
 		return false
 	}
@@ -281,3 +296,25 @@ func taskRemains(ctx context.Context, d *liveDSM, task approvedTask) bool {
 	}
 	return false
 }
+
+// DSM 7.1 has TaskScheduler list v2 (offset) and get v3 only. A read falls back
+// solely when DSM reports the method version unsupported; any other refusal stands.
+func onUnsupportedVersion(current, legacy func() (json.RawMessage, error)) (json.RawMessage, error) {
+	b, err := current()
+	var refused *dsmError
+	if errors.As(err, &refused) && versionUnsupported(refused.Code) {
+		return legacy()
+	}
+	return b, err
+}
+
+// DSM 7.1.1 returns 104 for a version above maxVersion (get v4) and 103 for a
+// method absent at an existing version (list v3).
+func versionUnsupported(code int) bool { return code == 103 || code == 104 }
+func listControlTasks(ctx context.Context, d *liveDSM) (json.RawMessage, error) {
+	return onUnsupportedVersion(func() (json.RawMessage, error) {
+		return d.call(ctx, "SYNO.Core.TaskScheduler", "list", "3", "", map[string]any{"start": 0, "limit": 500})
+	}, func() (json.RawMessage, error) {
+		return d.call(ctx, "SYNO.Core.TaskScheduler", "list", "2", "", map[string]any{"offset": 0, "limit": 500})
+	})
+}