@synopackageland/cli 0.7.0 → 0.7.2

package/dist/templates/compose/synology-app.yaml

@@ -3,6 +3,9 @@ package: com.synology.hello.files
 version: 0.1.0
 displayname: Hello Files
 description: A minimal headless app with a Shared Folder mount.
+# Package Center and DSM window icon: a square PNG of at least 256x256, or a
+# folder of icon_<size>.png. Omit to use the SDK default icon.
+# icon: assets/icon.png
 maintainer: Syno Package Land
 os_min_ver: "7.2.1-69057"
 

package/dist/templates/native-go/backend/go.mod

@@ -2,7 +2,7 @@ module dsmapp
 
 go 1.25.0
 
-toolchain go1.26.8
+toolchain go1.26.9
 
 require github.com/godbus/dbus/v5 v5.2.3-0.20260924123156-0ea052abeb82
 

package/dist/templates/native-go/backend/internal/filestation/client.go

@@ -21,6 +21,9 @@ const MaxBytes = 512 * 1024
 const maxMetadata = 1024 * 1024
 const PageSize = 100
 
+// downloadPeek bounds how much of a DSM 7.1 download is inspected for an error envelope.
+const downloadPeek = 4096
+
 // Client has no cookie jar or credentials. The destination is startup-owned,
 // literal loopback only; proxies, redirects and automatic retries are disabled.
 type Client struct {
@@ -269,15 +272,48 @@ func (c *Client) DownloadStream(ctx context.Context, r *http.Request, p string)
 	if e != nil {
 		return Download{}, e
 	}
-	disposition, _, _ := mime.ParseMediaType(resp.Header.Get("Content-Disposition"))
-	if disposition != "attachment" {
+	body := resp.Body
+	raw := resp.Header.Values("Content-Disposition")
+	if len(raw) == 0 {
+		// DSM 7.1 sends no Content-Disposition at all. Only a short body that is
+		// a complete DSM envelope is an error; everything else is the file.
+		if body, e = unlessEnvelope(resp); e != nil {
+			return Download{}, e
+		}
+	} else if disposition, _, _ := mime.ParseMediaType(raw[0]); len(raw) != 1 || disposition != "attachment" {
 		e = decode(resp, nil)
 		if e == nil {
 			e = fail("unavailable")
 		}
 		return Download{}, e
 	}
-	return Download{Body: resp.Body, ContentType: resp.Header.Get("Content-Type"), ContentDisposition: resp.Header.Get("Content-Disposition"), ContentLength: resp.ContentLength}, nil
+	return Download{Body: body, ContentType: resp.Header.Get("Content-Type"), ContentDisposition: resp.Header.Get("Content-Disposition"), ContentLength: resp.ContentLength}, nil
+}
+
+// unlessEnvelope returns the whole body as a stream unless it fits in the peek
+// and decodes as a DSM envelope, which is refused and never becomes content.
+func unlessEnvelope(resp *http.Response) (io.ReadCloser, error) {
+	head, e := io.ReadAll(io.LimitReader(resp.Body, downloadPeek+1))
+	if e != nil {
+		resp.Body.Close()
+		return nil, fail("read_failed")
+	}
+	if len(head) <= downloadPeek {
+		var envelope struct {
+			Success *bool `json:"success"`
+		}
+		if json.Unmarshal(head, &envelope) == nil && envelope.Success != nil {
+			resp.Body = io.NopCloser(bytes.NewReader(head))
+			if e = decode(resp, nil); e == nil {
+				e = fail("unavailable")
+			}
+			return nil, e
+		}
+	}
+	return struct {
+		io.Reader
+		io.Closer
+	}{io.MultiReader(bytes.NewReader(head), resp.Body), resp.Body}, nil
 }
 
 // Read is the bounded package-private job import, using the same stream.

package/dist/templates/native-go/backend/internal/filestation/download_dsm71_test.go

@@ -0,0 +1,82 @@
+package filestation
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+// DSM 7.1.1-42962 (vt-62, t-0231) answers Download v2 mode=download with the
+// file bytes and no Content-Disposition header. Its Content-Type was not
+// recorded, so every plausible type is covered.
+func dsm71Download(contentType, body string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if contentType != "" {
+			w.Header().Set("Content-Type", contentType)
+		}
+		fmt.Fprint(w, body)
+	}
+}
+
+func TestDSM71DownloadWithoutDispositionReturnsFileBytes(t *testing.T) {
+	for _, tt := range []struct{ contentType, body string }{
+		{"text/plain", "t0231 fixture a.txt"},
+		{"application/octet-stream", "\x00\x01binary"},
+		{"", "no type"},
+		{"application/json", `{"name":"a user file"}`},
+		{"application/json", `[{"success":false}]`},
+		{"text/plain", strings.Repeat("y", downloadPeek+7)},
+	} {
+		t.Run(tt.contentType, func(t *testing.T) {
+			c := fakeClient(t, dsm71Download(tt.contentType, tt.body))
+			b, err := c.Read(context.Background(), sessionRequest(), "/home/a")
+			if err != nil || string(b) != tt.body {
+				t.Fatalf("%v %q", err, b)
+			}
+		})
+	}
+}
+
+func TestDSM71DownloadStreamsBeyondThePeek(t *testing.T) {
+	body := strings.Repeat("z", MaxBytes*3)
+	c := fakeClient(t, dsm71Download("application/octet-stream", body))
+	d, err := c.DownloadStream(context.Background(), sessionRequest(), "/home/a")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer d.Body.Close()
+	b, err := io.ReadAll(d.Body)
+	if err != nil || string(b) != body || d.ContentType != "application/octet-stream" {
+		t.Fatal(err, len(b))
+	}
+}
+
+func TestDSM71DownloadEnvelopeWithoutDispositionIsNeverContent(t *testing.T) {
+	for _, tt := range []struct{ contentType, body, want string }{
+		{"application/json; charset=utf-8", `{"success":false,"error":{"code":408}}`, "denied"},
+		{"text/plain", `{"success":false,"error":{"code":119}}`, "session_required"},
+		{"", ` {"error":{"code":407},"success":false}` + "\n", "denied"},
+		{"application/json", `{"success":true,"data":{}}`, "unavailable"},
+	} {
+		t.Run(tt.want, func(t *testing.T) {
+			c := fakeClient(t, dsm71Download(tt.contentType, tt.body))
+			b, err := c.Read(context.Background(), sessionRequest(), "/home/a")
+			if err == nil || len(b) != 0 || !strings.Contains(err.Error(), tt.want) {
+				t.Fatalf("%v %q", err, b)
+			}
+		})
+	}
+}
+
+func TestNonAttachmentDispositionStaysRefused(t *testing.T) {
+	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Disposition", `inline; filename="a"`)
+		fmt.Fprint(w, "abc")
+	})
+	if b, err := c.Read(context.Background(), sessionRequest(), "/home/a"); err == nil || len(b) != 0 {
+		t.Fatal("inline disposition admitted")
+	}
+}

package/dist/templates/native-go/backend/internal/identity/README.md

@@ -16,7 +16,11 @@ The transport accepts same-origin JSON POST requests:
 - `identity.logout {}` removes the app session and clears the cookie.
 
 NormalUser.get is the only DSM cookie identity check; anonymous Initdata success
-cannot establish identity. Local `user.Lookup` binds the username to its UID.
+cannot establish identity. DSM web logins enable SynoToken, and DSM refuses
+their cookie alone (119), so the check also forwards the request's single
+`X-SYNO-TOKEN` header, which the DSM window's `ctx.call` sends. Sessions without
+SynoToken still verify with the cookie alone. The token is never put in a URL,
+logged or stored. Local `user.Lookup` binds the username to its UID.
 Auth login creates a temporary SID, then immediately logs it out before issuing
 an app session. A logout failure refuses the app login. No password, OTP, DSM SID
 or DSM cookie is logged or persisted. Only hashes of app bearer IDs are stored.

package/dist/templates/native-go/backend/internal/identity/dsm.go

@@ -9,6 +9,7 @@ import (
 	"net/url"
 	"strings"
 	"time"
+	"unicode"
 )
 
 type dsmReply struct {
@@ -25,7 +26,9 @@ type dsmReply struct {
 	} `json:"error"`
 }
 
-func (s *Service) dsmCall(ctx context.Context, form url.Values, cookie string) (dsmReply, error) {
+// dsmCall sends token only as X-SYNO-TOKEN: DSM web logins enable SynoToken,
+// and their cookie alone is refused with 119.
+func (s *Service) dsmCall(ctx context.Context, form url.Values, cookie, token string) (dsmReply, error) {
 	var out dsmReply
 	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
 	defer cancel()
@@ -37,6 +40,9 @@ func (s *Service) dsmCall(ctx context.Context, form url.Values, cookie string) (
 	if cookie != "" {
 		req.AddCookie(&http.Cookie{Name: "id", Value: cookie})
 	}
+	if token != "" {
+		req.Header.Set("X-SYNO-TOKEN", token)
+	}
 	res, err := s.cfg.Client.Do(req)
 	if err != nil {
 		return out, errors.New("DSM unavailable")
@@ -48,19 +54,32 @@ func (s *Service) dsmCall(ctx context.Context, form url.Values, cookie string) (
 	}
 	return out, nil
 }
-func (s *Service) verify(ctx context.Context, cookie string) (Subject, error) {
-	out, err := s.dsmCall(ctx, url.Values{"api": {"SYNO.Core.NormalUser"}, "method": {"get"}, "version": {"1"}}, cookie)
+
+// verify checks the caller's DSM session with the request's cookie and, when the
+// browser sent one, its SynoToken. Neither is stored or logged.
+func (s *Service) verify(r *http.Request, cookie string) (Subject, error) {
+	token := synoToken(r)
+	out, err := s.dsmCall(r.Context(), url.Values{"api": {"SYNO.Core.NormalUser"}, "method": {"get"}, "version": {"1"}}, cookie, token)
 	if err != nil || !out.Success {
 		return Subject{}, errors.New("DSM session refused")
 	}
 	return s.resolve(out.Data.Username)
 }
+
+// synoToken returns the single, well-formed X-SYNO-TOKEN header or "".
+func synoToken(r *http.Request) string {
+	values := r.Header.Values("X-SYNO-TOKEN")
+	if len(values) != 1 || len(values[0]) > 4096 || strings.ContainsFunc(values[0], unicode.IsControl) {
+		return ""
+	}
+	return values[0]
+}
 func (s *Service) login(ctx context.Context, account, password, otp string) (Subject, string) {
 	form := url.Values{"api": {"SYNO.API.Auth"}, "method": {"login"}, "version": {"7"}, "account": {account}, "passwd": {password}, "format": {"sid"}}
 	if otp != "" {
 		form.Set("otp_code", otp)
 	}
-	out, err := s.dsmCall(ctx, form, "")
+	out, err := s.dsmCall(ctx, form, "", "")
 	if err != nil {
 		return Subject{}, "auth_unavailable"
 	}
@@ -84,7 +103,7 @@ func (s *Service) login(ctx context.Context, account, password, otp string) (Sub
 	}
 	// The temporary DSM session exists only to prove identity. Dispose of it
 	// before issuing an application session, including when local lookup fails.
-	loggedOut, err := s.dsmCall(context.WithoutCancel(ctx), url.Values{"api": {"SYNO.API.Auth"}, "method": {"logout"}, "version": {"7"}, "_sid": {out.Data.SID}}, "")
+	loggedOut, err := s.dsmCall(context.WithoutCancel(ctx), url.Values{"api": {"SYNO.API.Auth"}, "method": {"logout"}, "version": {"7"}, "_sid": {out.Data.SID}}, "", "")
 	if err != nil || !loggedOut.Success {
 		return Subject{}, "auth_unavailable"
 	}

package/dist/templates/native-go/backend/internal/identity/http.go

@@ -237,7 +237,7 @@ func (s *Service) handle(w http.ResponseWriter, r *http.Request, req request) {
 					code = "session_required"
 					return nil
 				}
-				sub, err := s.verify(r.Context(), dc.Value)
+				sub, err := s.verify(r, dc.Value)
 				if err != nil {
 					code = "session_required"
 					return nil

package/dist/templates/native-go/backend/internal/identity/identity_test.go

@@ -27,6 +27,11 @@ type fixture struct {
 	logout  int
 	calls   []string
 	dir     string
+	// synoToken makes the fake DSM session a SynoToken session: NormalUser.get
+	// then needs the cookie and this X-SYNO-TOKEN header, as DSM web logins do.
+	synoToken string
+	// token is the X-SYNO-TOKEN the browser sends with each App request.
+	token string
 }
 
 func setup(t *testing.T) *fixture {
@@ -40,7 +45,10 @@ func setup(t *testing.T) *fixture {
 		switch name {
 		case "SYNO.Core.NormalUser.get":
 			c, err := r.Cookie("id")
-			if f.valid && err == nil && c.Value == "valid-dsm-cookie" {
+			if r.Form.Has("SynoToken") {
+				t.Error("SynoToken must travel only in the header")
+			}
+			if f.valid && err == nil && c.Value == "valid-dsm-cookie" && (f.synoToken == "" || r.Header.Get("X-SYNO-TOKEN") == f.synoToken) {
 				fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
 			} else {
 				fmt.Fprint(w, `{"success":false,"error":{"code":119}}`)
@@ -93,6 +101,9 @@ func (f *fixture) call(method, params string, appCookie *http.Cookie, dsmCookie
 	if dsmCookie {
 		req.AddCookie(&http.Cookie{Name: "id", Value: "valid-dsm-cookie"})
 	}
+	if f.token != "" {
+		req.Header.Set("X-SYNO-TOKEN", f.token)
+	}
 	out := httptest.NewRecorder()
 	f.service.Wrap(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		id, err := f.service.Authenticate(r)
@@ -148,6 +159,42 @@ func TestCookieExchangeAndNoInitdataShortcut(t *testing.T) {
 		}
 	}
 }
+func TestSynoTokenSessionBootstrapsAndRevalidates(t *testing.T) {
+	f := setup(t)
+	f.synoToken = "secret-syno-token"
+	if _, out := f.call("identity.session", `{"bootstrap":true}`, nil, true); errorCode(out) != "session_required" {
+		t.Fatalf("cookie alone must not pass a SynoToken session: %v", out)
+	}
+	f.token = "secret-syno-token"
+	rec, out := f.call("identity.session", `{"bootstrap":true}`, nil, true)
+	if errorCode(out) != "" {
+		t.Fatalf("bootstrap with SynoToken: %v", out)
+	}
+	c := sessionCookie(t, rec)
+	if _, out = f.call("greeting.set", `{"text":"x"}`, c, true); errorCode(out) != "" {
+		t.Fatalf("live revalidation with SynoToken: %v", out)
+	}
+	filepath.WalkDir(f.dir, func(path string, d os.DirEntry, err error) error {
+		if err != nil {
+			t.Fatal(err)
+		}
+		if raw, _ := os.ReadFile(path); !d.IsDir() && strings.Contains(string(raw), "secret-syno-token") {
+			t.Fatalf("SynoToken written to %s", path)
+		}
+		return nil
+	})
+	f.token = ""
+	if _, out = f.call("greeting.set", `{"text":"x"}`, c, true); errorCode(out) != "session_required" {
+		t.Fatalf("revalidation without SynoToken: %v", out)
+	}
+}
+func TestTokenlessSessionStillVerifiesWhenBrowserSendsToken(t *testing.T) {
+	f := setup(t)
+	f.token = "unused-token"
+	if _, out := f.call("identity.session", `{"bootstrap":true}`, nil, true); errorCode(out) != "" {
+		t.Fatal(out)
+	}
+}
 func TestLoginOTPLogoutAndNoCredentialsOnDisk(t *testing.T) {
 	f := setup(t)
 	f.otp = true

package/dist/templates/native-go/backend/internal/identity/service.go

@@ -145,7 +145,7 @@ func (s *Service) current(st *state, r *http.Request, revalidate bool) (string,
 		if err != nil || dc.Value == "" {
 			return "", record{}, errRevalidation
 		}
-		live, err := s.verify(r.Context(), dc.Value)
+		live, err := s.verify(r, dc.Value)
 		if err != nil || live != sub {
 			delete(st.Sessions, key)
 			return "", record{}, api.ErrNoSession

package/dist/templates/native-go/dsm-package.yaml

@@ -10,6 +10,9 @@ version: 0.1.0
 build: 1
 displayname: __DISPLAY_NAME__
 description: A native DSM package with a Go backend and a DSM window UI.
+# Package Center and DSM window icon: a square PNG of at least 256x256, or a
+# folder of icon_<size>.png. Omit to use the SDK default icon.
+# icon: assets/icon.png
 maintainer: Your Name
 # Optional INFO/website metadata. Omit fields you do not need.
 # metadata:

package/dist/templates/native-go-delegate/frontend/test/delegate.test.ts

@@ -128,3 +128,18 @@ test('startup waiting catalog covers exactly nine distinct language messages',()
  expect(Object.keys(waitingMessages).sort()).toEqual(['en','zh-TW','zh-CN','de','es','fr','it','ja','ko'].sort())
  expect(new Set(Object.values(waitingMessages)).size).toBe(9)
 })
+test('a blocked approval shows the DSM reason, not only the generic unavailable text',async()=>{
+ const setup:ExecutorSetup={control:vi.fn(async()=>({state:'ready'})),status:vi.fn(async()=>({state:'needs-admin-approval'})),authorize:vi.fn(async()=>({state:'blocked',reason:'dsm_104: scheduler readback or operation failed.'}))}
+ const root=mount(ExecutorSettings,{admin:true},setup);await settle();const password=root.querySelector('input[type="password"]') as HTMLInputElement;password.value='once';password.dispatchEvent(new Event('input',{bubbles:true}));await settle();root.querySelector('form')!.dispatchEvent(new Event('submit',{bubbles:true,cancelable:true}));await settle()
+ expect(root.textContent).toContain('Background file access is unavailable.');expect(root.textContent).toContain('Details: dsm_104: scheduler readback or operation failed.')
+})
+test('a task that is only missing shows no extra details',async()=>{
+ const setup:ExecutorSetup={control:vi.fn(async()=>({state:'ready'})),status:vi.fn(async()=>({state:'needs-admin-approval',reason:'Task is missing.'})),authorize:vi.fn(async()=>({state:'ready'}))}
+ const root=mount(ExecutorSettings,{admin:true},setup);await settle();expect(root.textContent).not.toContain('Task is missing.')
+})
+test('settings follow an approval made from the window panel',async()=>{
+ let notify:((r:{state:'ready'})=>void)|undefined
+ const setup={control:vi.fn(async()=>({state:'ready'})),status:vi.fn(async()=>({state:'needs-admin-approval'})),authorize:vi.fn(async()=>({state:'ready'})),subscribe:(listener:any)=>{notify=listener}} as ExecutorSetup
+ const root=mount(ExecutorSettings,{admin:true},setup);await settle();expect(root.textContent).toContain('An administrator must approve')
+ notify!({state:'ready'});await settle();expect(root.textContent).toContain('Background file access is ready.')
+})

package/dist/templates/native-go-root-ops/backend/internal/app/executor.go

@@ -9,6 +9,8 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"strings"
+	"syscall"
 	"time"
 
 	"dsmapp/internal/api"
@@ -51,8 +53,31 @@ func (cfg Config) executorControl(_ context.Context, caller api.Caller, raw json
 	return map[string]bool{"written": true}, nil
 }
 
+// The executor closes its socket while paused: the package is stopped, or an
+// upgrade changed the pins and awaits administrator approval.
 func (cfg Config) executorStatus(ctx context.Context, _ api.Caller, _ json.RawMessage) (any, error) {
-	return cfg.executorRequest(ctx, "status", nil, nil)
+	status, err := cfg.executorRequest(ctx, "status", nil, nil)
+	if errors.Is(err, syscall.ENOENT) || errors.Is(err, syscall.ECONNREFUSED) {
+		next := "Start the package."
+		if cfg.startRequested() {
+			next = "The package is running: an administrator approves background access again in Administrator setup; the executor log names the cause."
+		}
+		return map[string]any{"ready": false, "state": "paused", "reason": "executor_not_listening", "next": next}, nil
+	}
+	return status, err
+}
+
+// Package start and stop write the lifecycle mailbox; its last request tells a
+// stopped package from a running one whose executor stays paused.
+func (cfg Config) startRequested() bool {
+	f, err := os.Open(filepath.Join(cfg.DataDir, "executor", "control"))
+	if err != nil {
+		return false
+	}
+	defer f.Close()
+	b := make([]byte, 16)
+	n, _ := f.Read(b)
+	return strings.TrimSpace(string(b[:n])) == "start"
 }
 
 func (cfg Config) executorRootRun(ctx context.Context, caller api.Caller, req *http.Request, raw json.RawMessage) (any, error) {
@@ -73,8 +98,11 @@ func (cfg Config) executorRootRun(ctx context.Context, caller api.Caller, req *h
 	return cfg.executorRequest(ctx, "root.run", auth, map[string]string{"name": in.Name})
 }
 
+// executorSocketBase is a variable so tests can use a temporary directory.
+var executorSocketBase = "/run/synopkgland"
+
 func (cfg Config) executorRequest(ctx context.Context, op string, auth, params any) (any, error) {
-	conn, err := (&net.Dialer{Timeout: 5 * time.Second}).DialContext(ctx, "unix", "/run/synopkgland/"+cfg.PackageID+"/executor.sock")
+	conn, err := (&net.Dialer{Timeout: 5 * time.Second}).DialContext(ctx, "unix", filepath.Join(executorSocketBase, cfg.PackageID, "executor.sock"))
 	if err != nil {
 		return nil, err
 	}

package/dist/templates/native-go-root-ops/backend/internal/app/executor_test.go

@@ -1,8 +1,10 @@
 package app
 
 import (
+	"net"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -51,3 +53,65 @@ func TestExecutorRootRunRequiresCurrentDSMCookie(t *testing.T) {
 		t.Fatal("root.run accepted absent DSM cookie")
 	}
 }
+
+// The executor closes its listener while paused (package stopped, or pins
+// awaiting administrator approval). Status then answers, not "internal".
+func TestExecutorStatusReportsAPausedExecutor(t *testing.T) {
+	cfg := testConfig(t)
+	previous := executorSocketBase
+	// A short base: unix socket paths are limited to about 100 bytes.
+	base, err := os.MkdirTemp("/tmp", "exec")
+	if err != nil {
+		t.Fatal(err)
+	}
+	executorSocketBase = base
+	defer func() { executorSocketBase = previous; os.RemoveAll(base) }()
+	check := func(name string) {
+		t.Helper()
+		code, envelope := call(t, cfg, alice, "executor.status", `{}`)
+		out, _ := envelope["data"].(map[string]any)
+		if code != "" || out["ready"] != false || out["state"] != "paused" || out["reason"] != "executor_not_listening" || out["next"] == "" || out["next"] == nil {
+			t.Fatalf("%s: %s %v", name, code, out)
+		}
+	}
+	check("no socket")
+	if code, _ := call(t, cfg, bob, "executor.status", `{}`); code != "" {
+		t.Fatal("authenticated user cannot read a paused status", code)
+	}
+	dir := filepath.Join(executorSocketBase, cfg.PackageID)
+	os.MkdirAll(dir, 0700)
+	ln, err := net.ListenUnix("unix", &net.UnixAddr{Name: filepath.Join(dir, "executor.sock"), Net: "unix"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ln.SetUnlinkOnClose(false)
+	ln.Close()
+	check("closed listener")
+}
+
+// next follows the last lifecycle request: a running package needs approval
+// again, not a start.
+func TestExecutorStatusNextFollowsTheLifecycleRequest(t *testing.T) {
+	cfg := testConfig(t)
+	previous := executorSocketBase
+	executorSocketBase = t.TempDir()
+	defer func() { executorSocketBase = previous }()
+	next := func() string {
+		t.Helper()
+		_, envelope := call(t, cfg, alice, "executor.status", `{}`)
+		out, _ := envelope["data"].(map[string]any)
+		s, _ := out["next"].(string)
+		return s
+	}
+	if !strings.HasPrefix(next(), "Start the package.") {
+		t.Fatal("no request:", next())
+	}
+	mailbox := filepath.Join(cfg.DataDir, "executor")
+	os.MkdirAll(mailbox, 0700)
+	for request, start := range map[string]bool{"stop\n": true, "start\n": false, "start": false} {
+		os.WriteFile(filepath.Join(mailbox, "control"), []byte(request), 0600)
+		if got := next(); strings.HasPrefix(got, "Start the package") != start || got == "" {
+			t.Fatalf("%q: %s", request, got)
+		}
+	}
+}

package/dist/templates/native-go-vue/frontend/src/delegate/ExecutorSettings.vue

@@ -47,16 +47,17 @@ async function authorize(){
  catch{if(!disposed)error.value=true}
  finally{if(!disposed)busy.value=false}
 }
-onMounted(()=>void refresh());onBeforeUnmount(()=>{disposed=true;password.value=''})
+onMounted(()=>{setup.subscribe?.(next=>{if(!disposed)status.value=next});void refresh()});onBeforeUnmount(()=>{disposed=true;password.value=''})
 </script>
 <template>
  <SettingsSection v-if="admin" :title="copy.setupTitle" :collapsible="false" :aria-busy="busy">
   <p>{{ copy.setupHelp }}</p>
   <Callout v-if="error" tone="danger" role="alert">{{ copy.setupError }}</Callout>
   <p role="status">{{ status?.state==='ready'?(needsScope?copy.scopeNeeds:copy.ready):status?.state==='needs-admin-approval'?copy.needs:copy.blocked }}</p>
+  <p v-if="status?.reason&&(status.state==='blocked'||status.state==='unsupported')">{{ copy.details }}: {{ status.reason }}</p>
   <p v-if="scope?.selection">{{ copy.protectedScope }}: {{ scope.selection.root }}</p>
   <Callout v-if="scope?.mismatch" tone="warning">{{ copy.scopeMismatch }} {{ copy.preselection }}: {{ scope.preselection }} · {{ copy.protectedScope }}: {{ scope.selection?.root }}</Callout>
-  <Form v-if="status?.state==='needs-admin-approval'||dynamic&&status?.state==='ready'" @submit.prevent="authorize">
+  <Form v-if="status?.state==='needs-admin-approval'||status?.retry||dynamic&&status?.state==='ready'" @submit.prevent="authorize">
    <template v-if="dynamic">
     <p>{{ scope?.selection?copy.scopeChangeHelp:copy.preselectionHelp }}</p>
     <FormItem :label="copy.scopeLabel" label-for="delegate-scope"><Select id="delegate-scope" v-model="chosen" :options="options" :disabled="busy||error" /></FormItem>

package/dist/templates/native-go-vue/frontend/src/delegate/executor-settings.test.ts

@@ -0,0 +1,23 @@
+// @vitest-environment jsdom
+import {expect,test} from 'vitest'
+import {createApp,h,nextTick} from 'vue'
+import {AppRoot} from '@synopackageland/ui'
+import ExecutorSettings from './ExecutorSettings.vue'
+import {ExecutorSetupKey,type CapabilityStatus} from './executor-setup'
+const settle=async()=>{for(let i=0;i<10;i++){await nextTick();await new Promise(r=>setTimeout(r))}}
+// t-0237: a wrong password left only "Check status"; a retryable result keeps the form.
+test('a retryable blocked approval keeps the password form for another try',async()=>{
+ const blocked:CapabilityStatus&{retry:boolean}={state:'blocked',reason:'dsm_3121: DSM rejected the administrator password. Nothing was created.',retry:true}
+ const setup={async status():Promise<CapabilityStatus>{return {state:'needs-admin-approval'}},async authorize(){return blocked},async control(){return blocked}}
+ const root=document.createElement('div');document.body.append(root)
+ const app=createApp({render:()=>h(AppRoot,{},()=>h(ExecutorSettings,{admin:true,locale:'en'}))})
+ app.provide(ExecutorSetupKey,setup)
+ try{
+  app.mount(root);await settle()
+  const input=root.querySelector<HTMLInputElement>('#delegate-password')!
+  input.value='wrong';input.dispatchEvent(new Event('input'));await settle()
+  root.querySelector('form')!.dispatchEvent(new Event('submit'));await settle()
+  expect(root.textContent).toContain('dsm_3121')
+  expect(root.querySelector('#delegate-password')).not.toBeNull()
+ }finally{app.unmount();root.remove()}
+})

package/dist/templates/native-go-vue/frontend/src/delegate/executor-setup.ts

@@ -2,13 +2,17 @@ import {inject,type InjectionKey} from 'vue'
 export type CapabilityState='unsupported'|'needs-admin-approval'|'ready'|'blocked'|'incompatible'
 // requested: a scope change whose root task may still land; it applied once
 // status() reports that scope with a generation above this one.
-export interface CapabilityStatus {state:CapabilityState;reason?:string;requested?:{scope:string;generation:number}}
+// retry: approving again may succeed: nothing of this approval is left behind, or
+// the approved tasks remain and approving again restarts the executor.
+export interface CapabilityStatus {state:CapabilityState;reason?:string;requested?:{scope:string;generation:number};retry?:boolean}
 // p2-setup supplies the implementation through app.provide(ExecutorSetupKey, setup).
 // Passwords belong only to this call and must never be persisted or logged.
 export interface ExecutorSetup {
  status():Promise<CapabilityStatus>
  authorize(password:string,selectedScope?:string):Promise<CapabilityStatus>
  control(action:'start'|'stop'|'purge'):Promise<CapabilityStatus>
+ // Results of calls made elsewhere (the DSM window panel) on the same access.
+ subscribe?(listener:(status:CapabilityStatus)=>void):void
 }
 export const ExecutorSetupKey:InjectionKey<ExecutorSetup>=Symbol('executor-setup')
 export function useExecutorSetup():ExecutorSetup {

package/dist/templates/native-go-vue/frontend/src/delegate/i18n/de.json

@@ -10,6 +10,7 @@
   "ready": "Der Dateizugriff im Hintergrund ist bereit.",
   "needs": "Ein Administrator muss den Dateizugriff im Hintergrund genehmigen.",
   "blocked": "Der Dateizugriff im Hintergrund ist nicht verfügbar. Bitten Sie einen Administrator, die App-Einrichtung zu prüfen.",
+  "details": "Details",
   "refresh": "Aktualisieren",
   "revoke": "Widerrufen",
   "cancel": "Auftrag abbrechen",

package/dist/templates/native-go-vue/frontend/src/delegate/i18n/en.json

@@ -10,6 +10,7 @@
   "ready": "Background file access is ready.",
   "needs": "An administrator must approve background file access.",
   "blocked": "Background file access is unavailable. Ask an administrator to check the app setup.",
+  "details": "Details",
   "refresh": "Refresh",
   "revoke": "Revoke",
   "cancel": "Cancel job",

package/dist/templates/native-go-vue/frontend/src/delegate/i18n/es.json

@@ -10,6 +10,7 @@
   "ready": "El acceso a archivos en segundo plano está listo.",
   "needs": "Un administrador debe aprobar el acceso a archivos en segundo plano.",
   "blocked": "El acceso a archivos en segundo plano no está disponible. Pida a un administrador que revise la configuración de la aplicación.",
+  "details": "Detalles",
   "refresh": "Actualizar",
   "revoke": "Revocar",
   "cancel": "Cancelar tarea",

package/dist/templates/native-go-vue/frontend/src/delegate/i18n/fr.json

@@ -10,6 +10,7 @@
   "ready": "L’accès aux fichiers en arrière-plan est prêt.",
   "needs": "Un administrateur doit approuver l’accès aux fichiers en arrière-plan.",
   "blocked": "L’accès aux fichiers en arrière-plan n’est pas disponible. Demandez à un administrateur de vérifier la configuration de l’application.",
+  "details": "Détails",
   "refresh": "Actualiser",
   "revoke": "Révoquer",
   "cancel": "Annuler la tâche",

package/dist/templates/native-go-vue/frontend/src/delegate/i18n/it.json

@@ -10,6 +10,7 @@
   "ready": "L’accesso ai file in background è pronto.",
   "needs": "Un amministratore deve approvare l’accesso ai file in background.",
   "blocked": "L’accesso ai file in background non è disponibile. Chiedere a un amministratore di controllare la configurazione dell’app.",
+  "details": "Dettagli",
   "refresh": "Aggiorna",
   "revoke": "Revoca",
   "cancel": "Annulla processo",

package/dist/templates/native-go-vue/frontend/src/delegate/i18n/ja.json

@@ -10,6 +10,7 @@
   "ready": "バックグラウンドのファイルアクセスを利用できます。",
   "needs": "バックグラウンドのファイルアクセスには管理者の承認が必要です。",
   "blocked": "バックグラウンドのファイルアクセスを利用できません。アプリの設定を確認するよう管理者に依頼してください。",
+  "details": "詳細",
   "refresh": "最新の情報に更新",
   "revoke": "取り消す",
   "cancel": "ジョブをキャンセル",

package/dist/templates/native-go-vue/frontend/src/delegate/i18n/ko.json

@@ -10,6 +10,7 @@
   "ready": "백그라운드 파일 액세스를 사용할 수 있습니다.",
   "needs": "백그라운드 파일 액세스는 관리자의 승인이 필요합니다.",
   "blocked": "백그라운드 파일 액세스를 사용할 수 없습니다. 관리자에게 앱 설정을 확인하도록 요청하십시오.",
+  "details": "세부 사항",
   "refresh": "새로 고침",
   "revoke": "취소",
   "cancel": "작업 취소",