@synopackageland/cli 0.7.0 → 0.7.1

package/templates/_executor/pid.go

@@ -0,0 +1,37 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+)
+
+// approvedExecutable reports whether a /proc/<pid>/exe link and the inode it
+// runs (stat of that link) belong to an executor root installed in runtime.
+// The inode decides, not the name: kernel 3.10 (DSM 7.1) names a
+// rename-replaced inode after the rename source, so a monitor whose executor
+// was replaced reads as .executor (control.sh) or .executor-* (installAnchored)
+// "(deleted)". Only root writes runtime (root:root 0700), and a replaced inode
+// must be unlinked on the runtime's device.
+func approvedExecutable(link string, running os.FileInfo, runtime string, trusted func(os.FileInfo) bool) bool {
+	name, deleted := strings.CutSuffix(link, " (deleted)")
+	base := filepath.Base(name)
+	if filepath.Dir(name) != runtime || (base != "executor" && !strings.HasPrefix(base, ".executor")) {
+		return false
+	}
+	if !running.Mode().IsRegular() || !trusted(running) {
+		return false
+	}
+	if !deleted {
+		current, err := os.Lstat(filepath.Join(runtime, "executor"))
+		return err == nil && os.SameFile(running, current)
+	}
+	dir, err := os.Stat(runtime)
+	if err != nil {
+		return false
+	}
+	st, ok := running.Sys().(*syscall.Stat_t)
+	dt, dirOK := dir.Sys().(*syscall.Stat_t)
+	return ok && dirOK && st.Nlink == 0 && st.Dev == dt.Dev
+}

package/templates/_executor/pid_test.go

@@ -0,0 +1,113 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// runningExecutor installs runtime/executor and keeps it open, as a live monitor.
+func runningExecutor(t *testing.T) (string, *os.File) {
+	t.Helper()
+	runtime := t.TempDir()
+	path := filepath.Join(runtime, "executor")
+	if err := os.WriteFile(path, []byte("old"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	f, err := os.Open(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { f.Close() })
+	return runtime, f
+}
+
+// replaceExecutor renames a new copy over runtime/executor, as control.sh and
+// installAnchored do; the running inode is unlinked.
+func replaceExecutor(t *testing.T, runtime, staged string) {
+	t.Helper()
+	if err := os.WriteFile(filepath.Join(runtime, staged), []byte("new"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Rename(filepath.Join(runtime, staged), filepath.Join(runtime, "executor")); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func stat(t *testing.T, f *os.File) os.FileInfo {
+	t.Helper()
+	info, err := f.Stat()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return info
+}
+
+func TestApprovedExecutableAcceptsTheLiveRuntimeExecutor(t *testing.T) {
+	runtime, f := runningExecutor(t)
+	if !approvedExecutable(filepath.Join(runtime, "executor"), stat(t, f), runtime, trustAll) {
+		t.Fatal("live runtime executor refused")
+	}
+}
+
+// Kernel 3.10 (DSM 7.1 armv7) names a rename-replaced inode after the rename
+// source: control.sh stages .executor, installAnchored stages .executor-*.
+func TestApprovedExecutableAcceptsAReplacedExecutorUnderItsSwappedName(t *testing.T) {
+	for _, staged := range []string{".executor", ".executor-123456"} {
+		runtime, f := runningExecutor(t)
+		replaceExecutor(t, runtime, staged)
+		for _, name := range []string{staged, "executor"} {
+			link := filepath.Join(runtime, name) + " (deleted)"
+			if !approvedExecutable(link, stat(t, f), runtime, trustAll) {
+				t.Fatalf("replaced executor refused: %s", link)
+			}
+		}
+	}
+}
+
+func TestApprovedExecutableRefusesAnotherInode(t *testing.T) {
+	runtime, _ := runningExecutor(t)
+	other := filepath.Join(runtime, ".executor")
+	if err := os.WriteFile(other, []byte("other"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	f, err := os.Open(other)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	running := stat(t, f)
+	// Still linked: not the installed executor, whatever the link claims.
+	for _, link := range []string{other, other + " (deleted)", filepath.Join(runtime, "executor"), filepath.Join(runtime, "executor") + " (deleted)"} {
+		if approvedExecutable(link, running, runtime, trustAll) {
+			t.Fatalf("linked non-executor accepted as %s", link)
+		}
+	}
+}
+
+func TestApprovedExecutableRefusesAnUnlinkedInodeOutsideTheRuntime(t *testing.T) {
+	runtime, f := runningExecutor(t)
+	replaceExecutor(t, runtime, ".executor")
+	running := stat(t, f)
+	for _, link := range []string{
+		filepath.Join(t.TempDir(), "executor") + " (deleted)",
+		filepath.Join(runtime, "sh") + " (deleted)",
+		filepath.Join(runtime, ".executor"), // unlinked yet not reported deleted
+	} {
+		if approvedExecutable(link, running, runtime, trustAll) {
+			t.Fatalf("unlinked inode accepted as %s", link)
+		}
+	}
+}
+
+func TestApprovedExecutableRefusesAnUntrustedInode(t *testing.T) {
+	runtime, f := runningExecutor(t)
+	refuse := func(os.FileInfo) bool { return false }
+	if approvedExecutable(filepath.Join(runtime, "executor"), stat(t, f), runtime, refuse) {
+		t.Fatal("untrusted live executor accepted")
+	}
+	replaceExecutor(t, runtime, ".executor")
+	if approvedExecutable(filepath.Join(runtime, ".executor")+" (deleted)", stat(t, f), runtime, refuse) {
+		t.Fatal("untrusted replaced executor accepted")
+	}
+}

package/templates/_executor/platform_other.go

@@ -8,6 +8,7 @@ import (
 	"net"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 	"syscall"
 )
@@ -19,7 +20,14 @@ var errLinux = errors.New("executor requires Linux")
 func ownedByRoot(os.FileInfo) bool  { return false }
 func configureProcess(*exec.Cmd)    {}
 func peerUID(net.Conn) (int, error) { return -1, errLinux }
+
+// Like Linux openBeneath, refuse a symlink in any component, not only the last.
 func openRegular(path string) (*os.File, error) {
+	for dir := filepath.Dir(path); dir != filepath.Dir(dir); dir = filepath.Dir(dir) {
+		if info, err := os.Lstat(dir); err != nil || info.Mode()&os.ModeSymlink != 0 {
+			return nil, errors.New("path")
+		}
+	}
 	info, err := os.Lstat(path)
 	if err != nil {
 		return nil, err

package/templates/_executor/purge_log.go

@@ -0,0 +1,18 @@
+package main
+
+import (
+	"log"
+	"log/syslog"
+)
+
+// Purge removes executor.log with the protected state, so its diagnostics
+// also go to the system log, where they survive the uninstall.
+func purgeLogger() func(string) {
+	system, err := syslog.New(syslog.LOG_NOTICE|syslog.LOG_DAEMON, "synopkgland-executor")
+	return func(s string) {
+		log.Print(s)
+		if err == nil {
+			_ = system.Notice(s)
+		}
+	}
+}

package/templates/_executor/tasks.go

@@ -6,10 +6,12 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
 	"synopkgland/executor/internal/taskscript"
+	"time"
 )
 
 type approvedTask struct {
@@ -51,8 +53,7 @@ func taskReference(ctx context.Context, d *liveDSM, task approvedTask, expected
 	boot := task.Kind == "boot"
 	if !boot {
 		api = "SYNO.Core.TaskScheduler"
-		version = "4"
-		b, err := d.call(ctx, api, "list", "3", "", map[string]any{"start": 0, "limit": 500})
+		b, err := listControlTasks(ctx, d)
 		if err != nil {
 			return "", "", nil, err
 		}
@@ -83,7 +84,14 @@ func taskReference(ctx context.Context, d *liveDSM, task approvedTask, expected
 		}
 		ref = map[string]any{"id": id, "real_owner": "root"}
 	}
-	b, err := d.call(ctx, api, "get", version, "", ref)
+	var b json.RawMessage
+	var err error
+	if boot {
+		b, err = d.call(ctx, api, "get", version, "", ref)
+	} else {
+		b, err = onUnsupportedVersion(func() (json.RawMessage, error) { return d.call(ctx, api, "get", "4", "", ref) },
+			func() (json.RawMessage, error) { return d.call(ctx, api, "get", "3", "", ref) })
+	}
 	if err != nil {
 		return "", "", nil, err
 	}
@@ -225,20 +233,24 @@ func purgeTasks(ctx context.Context, d *liveDSM, pkg string, inv taskInventory,
 				expected = canonical.Script
 			}
 		}
+		started := time.Now()
 		api, version, ref, err := taskReference(ctx, d, task, expected)
 		if err != nil {
 			log("task cleanup skipped: " + task.Kind + " definition mismatch or unavailable")
 			continue
 		}
-		if _, err = d.call(ctx, api, "delete", version, "", ref); err != nil {
+		looked := time.Now()
+		if err = d.mutate(ctx, api, "delete", version, ref); err != nil {
 			log("task cleanup unconfirmed: " + task.Kind)
 		}
+		deleted := time.Now()
 		// The scheduler has no conditional delete. Accept the admin edit window,
 		// delete exactly once, and observe the name afterward without another delete.
 		if taskRemains(ctx, d, task) {
 			log("task cleanup: " + task.Kind + " same-named task remains after delete")
 		}
-
+		log(fmt.Sprintf("task cleanup timing: package=%s kind=%s lookup_ms=%d delete_ms=%d verify_ms=%d", pkg, task.Kind,
+			looked.Sub(started).Milliseconds(), deleted.Sub(looked).Milliseconds(), time.Since(deleted).Milliseconds()))
 	}
 }
 
@@ -246,8 +258,12 @@ func purgeWithInventory(ctx context.Context, d *liveDSM, pkg string, inv taskInv
 	if runtime != filepath.Join(state, "runtime") {
 		return errors.New("runtime outside package protected state")
 	}
+	started := time.Now()
 	purgeTasks(ctx, d, pkg, inv, log)
-	return finishControl(state, runtime, socket, true)
+	cleaned := time.Now()
+	err := finishControl(state, runtime, socket, true)
+	log(fmt.Sprintf("purge timing: package=%s tasks_ms=%d files_ms=%d", pkg, cleaned.Sub(started).Milliseconds(), time.Since(cleaned).Milliseconds()))
+	return err
 }
 
 func taskRemains(ctx context.Context, d *liveDSM, task approvedTask) bool {
@@ -261,7 +277,7 @@ func taskRemains(ctx context.Context, d *liveDSM, task approvedTask) bool {
 		}
 		return json.Unmarshal(b, &got) == nil && got.Name == task.Name
 	}
-	b, err := d.call(ctx, "SYNO.Core.TaskScheduler", "list", "3", "", map[string]any{"start": 0, "limit": 500})
+	b, err := listControlTasks(ctx, d)
 	if err != nil {
 		return false
 	}
@@ -280,3 +296,25 @@ func taskRemains(ctx context.Context, d *liveDSM, task approvedTask) bool {
 	}
 	return false
 }
+
+// DSM 7.1 has TaskScheduler list v2 (offset) and get v3 only. A read falls back
+// solely when DSM reports the method version unsupported; any other refusal stands.
+func onUnsupportedVersion(current, legacy func() (json.RawMessage, error)) (json.RawMessage, error) {
+	b, err := current()
+	var refused *dsmError
+	if errors.As(err, &refused) && versionUnsupported(refused.Code) {
+		return legacy()
+	}
+	return b, err
+}
+
+// DSM 7.1.1 returns 104 for a version above maxVersion (get v4) and 103 for a
+// method absent at an existing version (list v3).
+func versionUnsupported(code int) bool { return code == 103 || code == 104 }
+func listControlTasks(ctx context.Context, d *liveDSM) (json.RawMessage, error) {
+	return onUnsupportedVersion(func() (json.RawMessage, error) {
+		return d.call(ctx, "SYNO.Core.TaskScheduler", "list", "3", "", map[string]any{"start": 0, "limit": 500})
+	}, func() (json.RawMessage, error) {
+		return d.call(ctx, "SYNO.Core.TaskScheduler", "list", "2", "", map[string]any{"offset": 0, "limit": 500})
+	})
+}

package/templates/_executor/tasks_dsm71_test.go

@@ -0,0 +1,114 @@
+package main
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// dsm71Scheduler answers like DSM 7.1.1-42962 (vt-62): TaskScheduler stops at
+// list v2 (offset/limit) and get v3. t-0234 measured the refusals: a version
+// above maxVersion 3 returns 104; a method absent at an existing version, 103.
+type dsm71Scheduler struct {
+	recordingScheduler
+	refusal string
+}
+
+func (s *dsm71Scheduler) Exec(ctx context.Context, path string, args []string) ([]byte, error) {
+	api, method, version := schedulerCall(args)
+	s.calls = append(s.calls, api+" "+method+" v"+version)
+	if api == "SYNO.Core.TaskScheduler" {
+		if method == "list" && version == "3" && s.refusal != "" {
+			return []byte(`{"success":false,"error":{"code":` + s.refusal + `}}`), nil
+		}
+		supported := map[string]string{"list": "2", "get": "3", "delete": "2", "run": "2"}
+		if supported[method] != version {
+			if version > "3" {
+				return []byte(`{"success":false,"error":{"code":104}}`), nil
+			}
+			return []byte(`{"success":false,"error":{"code":103}}`), nil
+		}
+		if method == "list" && (!contains(args, "offset=0") || !contains(args, "limit=500")) {
+			return []byte(`{"success":false,"error":{"code":101}}`), nil
+		}
+	}
+	return s.schedulerFixture.Exec(ctx, path, args)
+}
+
+func purgeWith(t *testing.T, cmd Command) {
+	t.Helper()
+	inventory := taskInventory{Package: "TestApp", PolicyDigest: strings.Repeat("b", 64), Tasks: []approvedTask{{Kind: "boot", Name: "TestApp executor boot", ScriptDigest: canonicalTaskDigest(t, "boot")}, {Kind: "control", Name: "TestApp executor control", ScriptDigest: canonicalTaskDigest(t, "control")}}}
+	state := filepath.Join(t.TempDir(), "state")
+	socket := filepath.Join(t.TempDir(), "socket")
+	os.MkdirAll(filepath.Join(state, "runtime"), 0700)
+	os.MkdirAll(socket, 0700)
+	if err := purgeWithInventory(context.Background(), &liveDSM{Command: cmd}, "TestApp", inventory, state, filepath.Join(state, "runtime"), socket, func(string) {}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestPurgeFindsAndDeletesBothTasksOnDSM71(t *testing.T) {
+	cmd := &dsm71Scheduler{}
+	purgeWith(t, cmd)
+	if strings.Join(cmd.deleted, ",") != "SYNO.Core.EventScheduler,SYNO.Core.TaskScheduler" {
+		t.Fatal("DSM 7.1 tasks left behind", cmd.deleted, cmd.calls)
+	}
+}
+
+func TestSchedulerReadFallsBackOnlyOnUnsupportedVersion(t *testing.T) {
+	for _, code := range []string{"105", "119", "102", "3121"} {
+		t.Run(code, func(t *testing.T) {
+			cmd := &dsm71Scheduler{refusal: code}
+			purgeWith(t, cmd)
+			for _, call := range cmd.calls {
+				if call == "SYNO.Core.TaskScheduler list v2" || call == "SYNO.Core.TaskScheduler get v3" {
+					t.Fatal("fell back after code", code, cmd.calls)
+				}
+			}
+			if contains(cmd.deleted, "SYNO.Core.TaskScheduler") {
+				t.Fatal("deleted without exact readback", cmd.deleted)
+			}
+		})
+	}
+}
+
+func TestModernSchedulerNeverUsesLegacyVersions(t *testing.T) {
+	cmd := &recordingScheduler{}
+	purgeWith(t, cmd)
+	for _, call := range cmd.calls {
+		if call == "SYNO.Core.TaskScheduler list v2" || call == "SYNO.Core.TaskScheduler get v3" {
+			t.Fatal("modern DSM used a legacy version", cmd.calls)
+		}
+	}
+	if len(cmd.deleted) != 2 {
+		t.Fatal(cmd.deleted)
+	}
+}
+
+type recordingScheduler struct {
+	schedulerFixture
+	calls []string
+}
+
+func (s *recordingScheduler) Exec(ctx context.Context, path string, args []string) ([]byte, error) {
+	api, method, version := schedulerCall(args)
+	s.calls = append(s.calls, api+" "+method+" v"+version)
+	return s.schedulerFixture.Exec(ctx, path, args)
+}
+
+func schedulerCall(args []string) (api, method, version string) {
+	for _, a := range args {
+		k, v, _ := strings.Cut(a, "=")
+		switch k {
+		case "api":
+			api = v
+		case "method":
+			method = v
+		case "version":
+			version = v
+		}
+	}
+	return
+}

package/templates/_executor/tasks_test.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"synopkgland/executor/internal/taskscript"
 	"testing"
@@ -14,7 +15,9 @@ import (
 type schedulerFixture struct {
 	changed, foreignOwner, duplicate bool
 	script                           string
-	deleted                          []string
+	// deleteReply replaces the delete envelope, as DSM sends it.
+	deleteReply string
+	deleted     []string
 }
 
 func (s *schedulerFixture) Exec(_ context.Context, _ string, args []string) ([]byte, error) {
@@ -48,6 +51,9 @@ func (s *schedulerFixture) Exec(_ context.Context, _ string, args []string) ([]b
 		if api == "SYNO.Core.TaskScheduler" && !contains(args, `tasks=[{"id":7,"real_owner":"root"}]`) {
 			return nil, errors.New("wrong delete reference")
 		}
+		if s.deleteReply != "" {
+			return []byte(s.deleteReply), nil
+		}
 		data = map[string]any{}
 	} else if api == "SYNO.Core.EventScheduler" {
 		data = map[string]any{"task_name": "TestApp executor boot", "owner": map[string]string{"0": owner}, "operation": script, "operation_type": "script", "event": "bootup", "enable": true}
@@ -164,3 +170,54 @@ func canonicalTaskDigest(t *testing.T, kind string) string {
 	t.Fatal("task kind")
 	return ""
 }
+
+// t-0229: preuninst took 15-23 s; time each scheduler phase and the file
+// removal separately, naming the package, so a device log shows which waits.
+func TestPurgeLogsPhaseTimingWithPackageName(t *testing.T) {
+	cmd := &schedulerFixture{}
+	inventory := taskInventory{Package: "TestApp", PolicyDigest: strings.Repeat("b", 64), Tasks: []approvedTask{{Kind: "boot", Name: "TestApp executor boot", ScriptDigest: canonicalTaskDigest(t, "boot")}, {Kind: "control", Name: "TestApp executor control", ScriptDigest: canonicalTaskDigest(t, "control")}}}
+	state := filepath.Join(t.TempDir(), "state")
+	socket := filepath.Join(t.TempDir(), "socket")
+	os.MkdirAll(filepath.Join(state, "runtime"), 0700)
+	os.MkdirAll(socket, 0700)
+	logs := []string{}
+	if err := purgeWithInventory(context.Background(), &liveDSM{Command: cmd}, "TestApp", inventory, state, filepath.Join(state, "runtime"), socket, func(s string) { logs = append(logs, s) }); err != nil {
+		t.Fatal(err)
+	}
+	task := regexp.MustCompile(`^task cleanup timing: package=TestApp kind=(boot|control) lookup_ms=\d+ delete_ms=\d+ verify_ms=\d+$`)
+	total := regexp.MustCompile(`^purge timing: package=TestApp tasks_ms=\d+ files_ms=\d+$`)
+	kinds := []string{}
+	for _, line := range logs {
+		if m := task.FindStringSubmatch(line); m != nil {
+			kinds = append(kinds, m[1])
+		}
+	}
+	if strings.Join(kinds, ",") != "boot,control" || len(logs) == 0 || !total.MatchString(logs[len(logs)-1]) {
+		t.Fatal(logs)
+	}
+}
+
+// t-0237: EventScheduler delete v1 and TaskScheduler delete v2 answer a success
+// without data; that is a confirmed delete, while a refusal stays unconfirmed.
+func TestPurgeConfirmsDatalessDeleteSuccess(t *testing.T) {
+	for reply, unconfirmed := range map[string]bool{
+		`{"success":true}`:                        false,
+		`{"httpd_restart":false,"success":true}`:  false,
+		`{"success":false,"error":{"code":4800}}`: true,
+		`{"success":true,"error":{"code":4800}}`:  true,
+	} {
+		cmd := &schedulerFixture{deleteReply: reply}
+		inventory := taskInventory{Package: "TestApp", PolicyDigest: strings.Repeat("b", 64), Tasks: []approvedTask{{Kind: "boot", Name: "TestApp executor boot", ScriptDigest: canonicalTaskDigest(t, "boot")}, {Kind: "control", Name: "TestApp executor control", ScriptDigest: canonicalTaskDigest(t, "control")}}}
+		logs := []string{}
+		purgeTasks(context.Background(), &liveDSM{Command: cmd}, "TestApp", inventory, func(s string) { logs = append(logs, s) })
+		found := 0
+		for _, line := range logs {
+			if strings.HasPrefix(line, "task cleanup unconfirmed: ") {
+				found++
+			}
+		}
+		if (found == 2) != unconfirmed || (found != 0 && found != 2) || len(cmd.deleted) != 2 {
+			t.Fatal(reply, logs)
+		}
+	}
+}

package/templates/_executor/upgrade_watch_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"net"
 	"os"
 	"path/filepath"
@@ -70,13 +71,20 @@ func TestUpgradeGapPreservesRuntimeAndResumesOnlyApprovedPins(t *testing.T) {
 						}
 						opened.Add(1)
 						return func() { listener.Close(); closed.Add(1) }, nil
-					}, func(ctx context.Context) bool { return samePackagePins(ctx, target, ed, pd) }, func() error {
+					}, func(ctx context.Context) bool {
+						// The production decision: only differing pins ask for approval.
+						pins := packagePins(ctx, target, info, func(os.FileInfo) bool { return true }, ed, pd)
+						return approvedPins(pins, func() error { return errors.New("no anchored upgrade here") }, func() error { return nil }, func(message string) {
+							if strings.Contains(message, "administrator approval") {
+								select {
+								case approval <- struct{}{}:
+								default:
+								}
+							}
+						})
+					}, func() error {
 						purged.Add(1)
 						return finishControl(state, filepath.Join(state, "runtime"), sockDir, true)
-					}, func(message string) {
-						if strings.Contains(message, "administrator approval") {
-							approval <- struct{}{}
-						}
 					})
 				}()
 				t.Cleanup(func() {

package/templates/_gateway/go.mod

@@ -1,3 +1,5 @@
 module synopkgland-gateway
 
 go 1.24
+
+toolchain go1.26.9

package/templates/native-go/backend/go.mod

@@ -2,7 +2,7 @@ module dsmapp
 
 go 1.25.0
 
-toolchain go1.26.8
+toolchain go1.26.9
 
 require github.com/godbus/dbus/v5 v5.2.3-0.20260924123156-0ea052abeb82
 

package/templates/native-go/backend/internal/filestation/client.go

@@ -21,6 +21,9 @@ const MaxBytes = 512 * 1024
 const maxMetadata = 1024 * 1024
 const PageSize = 100
 
+// downloadPeek bounds how much of a DSM 7.1 download is inspected for an error envelope.
+const downloadPeek = 4096
+
 // Client has no cookie jar or credentials. The destination is startup-owned,
 // literal loopback only; proxies, redirects and automatic retries are disabled.
 type Client struct {
@@ -269,15 +272,48 @@ func (c *Client) DownloadStream(ctx context.Context, r *http.Request, p string)
 	if e != nil {
 		return Download{}, e
 	}
-	disposition, _, _ := mime.ParseMediaType(resp.Header.Get("Content-Disposition"))
-	if disposition != "attachment" {
+	body := resp.Body
+	raw := resp.Header.Values("Content-Disposition")
+	if len(raw) == 0 {
+		// DSM 7.1 sends no Content-Disposition at all. Only a short body that is
+		// a complete DSM envelope is an error; everything else is the file.
+		if body, e = unlessEnvelope(resp); e != nil {
+			return Download{}, e
+		}
+	} else if disposition, _, _ := mime.ParseMediaType(raw[0]); len(raw) != 1 || disposition != "attachment" {
 		e = decode(resp, nil)
 		if e == nil {
 			e = fail("unavailable")
 		}
 		return Download{}, e
 	}
-	return Download{Body: resp.Body, ContentType: resp.Header.Get("Content-Type"), ContentDisposition: resp.Header.Get("Content-Disposition"), ContentLength: resp.ContentLength}, nil
+	return Download{Body: body, ContentType: resp.Header.Get("Content-Type"), ContentDisposition: resp.Header.Get("Content-Disposition"), ContentLength: resp.ContentLength}, nil
+}
+
+// unlessEnvelope returns the whole body as a stream unless it fits in the peek
+// and decodes as a DSM envelope, which is refused and never becomes content.
+func unlessEnvelope(resp *http.Response) (io.ReadCloser, error) {
+	head, e := io.ReadAll(io.LimitReader(resp.Body, downloadPeek+1))
+	if e != nil {
+		resp.Body.Close()
+		return nil, fail("read_failed")
+	}
+	if len(head) <= downloadPeek {
+		var envelope struct {
+			Success *bool `json:"success"`
+		}
+		if json.Unmarshal(head, &envelope) == nil && envelope.Success != nil {
+			resp.Body = io.NopCloser(bytes.NewReader(head))
+			if e = decode(resp, nil); e == nil {
+				e = fail("unavailable")
+			}
+			return nil, e
+		}
+	}
+	return struct {
+		io.Reader
+		io.Closer
+	}{io.MultiReader(bytes.NewReader(head), resp.Body), resp.Body}, nil
 }
 
 // Read is the bounded package-private job import, using the same stream.