@synopackageland/cli 0.8.0 → 0.9.0

package/dist/standalone/daemon.js

@@ -1,7 +1,7 @@
 import { chmodSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem } from "../build-spk/go-toolchain.js";
-import { templatesRoot } from "../template-paths.js";
+import { goAssetDir } from "../template-paths.js";
 import { checkCgiBinary } from "./binary.js";
 import { StandaloneBuildError } from "./spk.js";
 const fields = new Set(["exec", "targets", "args", "env", "timeouts", "uninstall_args"]);
@@ -60,7 +60,7 @@ export async function buildDaemonControl(manifest, arch, work, run) {
         return undefined;
     const out = join(work, `daemon-control-${arch}`);
     const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", out, "."], {
-        cwd: join(templatesRoot(), "_daemon"), env: { ...process.env, ...pinnedGoBuildEnv(arch) },
+        cwd: goAssetDir("daemon"), env: { ...process.env, ...pinnedGoBuildEnv(arch) },
     });
     if (result.missing || result.status !== 0)
         throw new StandaloneBuildError("STANDALONE_DAEMON_BUILD_FAILED", `daemon controller build failed (${arch}). ${PINNED_GO_HINT}\n${result.stderr}`);

package/dist/standalone/dsm-window.js

@@ -1,6 +1,6 @@
 import { REOPEN_EVENTS_RUNTIME } from "./reopen-events.js";
 import { DSM_LANGS } from "./i18n.js";
-import { PASSWORD_CONFIRM, ROOT_PANEL, ROOT_RUNTIME, rootTasks } from "./root-window.js";
+import { PASSWORD_CONFIRM, ROOT_PANEL, ROOT_RUNTIME } from "./root-window.js";
 import { HOST_ADAPTER_RUNTIME } from "./host-adapter.js";
 import { permitsOrdinaryUsers } from "./api-permissions.js";
 import { PORTAL_RUNTIME } from "./portal-window.js";
@@ -320,7 +320,7 @@ function settingsOnlyApproval(manifest) {
  */
 function renderRootParts(ns, manifest) {
     return {
-        definitions: `${ns}.rootTasks = ${JSON.stringify(rootTasks(manifest.executor))};
+        definitions: `${ns}.rootTasks = ${JSON.stringify(manifest.executor.tasks)};
 ${ns}.createRootAccess = (function () {
 ${ROOT_RUNTIME}
   return createRootAccess;

package/dist/standalone/manifest.d.ts

@@ -1,6 +1,6 @@
 import { type PackageMetadata } from "../package-metadata.js";
 import { type DelegateCapability } from "../runtime/executor-policy.js";
-import type { ExecutorPins } from "../runtime/executor-tasks.js";
+import type { ExecutorPins, ExecutorTask } from "../runtime/executor-tasks.js";
 import { type NativeArchFamily } from "../build-spk/dsm-arch.js";
 import { type Catalogs, type InfoTranslations } from "./i18n.js";
 export type { InfoText } from "./i18n.js";
@@ -58,7 +58,10 @@ export interface StandaloneManifest {
     capabilities: Capabilities;
     /** Fixed root/<name>.sh operations, enabled by capabilities.rootOps. */
     rootOps?: RootOp[];
-    executor?: ExecutorPins;
+    /** Set by build: the pins and the root tasks generated from the App's SDK executor. */
+    executor?: ExecutorPins & {
+        tasks: ExecutorTask[];
+    };
     daemon?: Daemon;
     /** `install.sharedFolder`: the Shared Folder the install wizard selects or `data-share` creates. */
     sharedFolder?: SharedFolder;

package/dist/standalone/manifest.js

@@ -14,6 +14,8 @@ import { floorAtAdministrators, permitsOrdinaryUsers, readApiPermissions } from
 import { readPortalDeclaration } from "../portal/alias.js";
 import { renderPackageIcons } from "../build-spk/dsm-icons.js";
 import { validateReproducible } from "../reproducible-config.js";
+import { SDK_MODULE, sdkRequirement } from "../runtime/sdk-source.js";
+import { sdkProblems } from "./sdk-check.js";
 /**
  * `dsm-package.yaml`: a Standalone Package, i.e. an unsigned native SPK that
  * runs as its own DSM package account with a CGI backend and a DSM window UI.
@@ -151,7 +153,7 @@ function readManifest(raw, c) {
     const sharedFolder = raw.install === undefined ? undefined : readSharedFolder(raw.install, e => c.fail(e.code, e.message));
     const entry = raw.entry === undefined ? undefined : readEntry(raw.entry, backend, permissions?.policy, c);
     if (entry === "admin-only" && permissions) {
-        const floored = floorAtAdministrators(permissions.policy);
+        const floored = floorAtAdministrators(permissions.policy, permissions.sdk);
         if (floored.widened.length) {
             c.fail("STANDALONE_ENTRY_WIDENED", `entry: admin-only 以管理員為所有 route 的下限；permissions.json 的 ${floored.widened.join("、")} 會開放給其他人。請改為 administrators，或改用 entry: app-privilege／省略 entry。`);
         }
@@ -162,6 +164,10 @@ function readManifest(raw, c) {
         c.fail("CAPABILITY_COMBINATION_INVALID", "capabilities.identity 需要獨立登入頁；plain UI 不支援，請改用 vue UI（init --ui vue）。");
     if (capabilities.delegate?.scope === "install-selected" && ui && !ui.build)
         c.fail("CAPABILITY_COMBINATION_INVALID", "delegate scope install-selected 只能在 Vue 面板確認；plain UI 不支援，請改用 vue UI（init --ui vue）。");
+    if (backend?.kind === "go") {
+        for (const problem of sdkProblems(backend.dir, ui?.build?.cwd, Boolean(capabilities.delegate || capabilities.rootOps)))
+            c.fail(problem.code, problem.message);
+    }
     const i18n = raw.i18n === undefined ? undefined : readI18n(raw.i18n, c);
     const icon = raw.icon === undefined ? undefined : readIcon(raw.icon, c);
     const portal = raw.portal === undefined || !packageId ? undefined : readPortalDeclaration(raw.portal, packageId)
@@ -222,9 +228,9 @@ function readEntry(value, backend, policy, c) {
     if (!backend)
         return undefined;
     const main = backend.kind === "go" ? join(backend.dir, backend.main, "main.go") : "";
-    if (backend.kind !== "go" || !existsSync(join(backend.dir, "internal/dsm/entry.go"))
+    if (backend.kind !== "go" || !sdkRequirement(backend.dir)
         || !existsSync(main) || !readFileSync(main, "utf8").includes("dsm.NewEntryGate(")) {
-        return c.fail("STANDALONE_ENTRY_UNSUPPORTED", "entry 需要 Go backend 內的 SDK entry gate：請從 SDK 範本複製 internal/dsm/entry.go、apppriv.go 與 native bridge，並在 cmd/app/main.go 以 dsm.NewEntryGate 包住 authenticator。");
+        return c.fail("STANDALONE_ENTRY_UNSUPPORTED", `entry 需要 SDK 的 entry gate：backend/go.mod 要 require ${SDK_MODULE}，並在 cmd/app/main.go 以 dsm.NewEntryGate 包住 authenticator。`);
     }
     if (value === "app-privilege" && !permitsOrdinaryUsers(policy)) {
         return c.fail("STANDALONE_ENTRY_INVALID", "entry: app-privilege 需要至少一個 permissions.json 標為 authenticated 的 route，一般使用者才有功能可用。");

package/dist/standalone/root-window.d.ts

@@ -1,4 +1,4 @@
-export { executorTasks as rootTasks, type ExecutorTask as RootTask } from '../runtime/executor-tasks.js';
+export { type ExecutorTask as RootTask } from '../runtime/executor-tasks.js';
 /** Exact readback is authoritative. PasswordConfirm tokens are reused immediately,
  * across both Root APIs, and never persisted (DSM validity is about 300 seconds). */
 export declare const ROOT_RUNTIME: string;

package/dist/standalone/root-window.js

@@ -1,7 +1,6 @@
 import { bootDefinition, controlDefinition } from '../runtime/executor-tasks.js';
 import { executorScopeTask } from '../runtime/executor-scope-task.js';
 import { versionUnsupported } from '../runtime/dsm-version.js';
-export { executorTasks as rootTasks } from '../runtime/executor-tasks.js';
 /** Exact readback is authoritative. PasswordConfirm tokens are reused immediately,
  * across both Root APIs, and never persisted (DSM validity is about 300 seconds). */
 export const ROOT_RUNTIME = `function createRootAccess(options) {

package/dist/standalone/sdk-check.d.ts

@@ -0,0 +1,9 @@
+export interface SdkProblem {
+    code: string;
+    message: string;
+}
+/**
+ * backend/go.mod names the App's SDK version; the frontend package and this
+ * CLI must agree with it. `needsSdk`: the App declares delegate or rootOps.
+ */
+export declare function sdkProblems(backendDir: string, frontendDir: string | undefined, needsSdk: boolean, cliVersion?: string): SdkProblem[];

package/dist/standalone/sdk-check.js

@@ -0,0 +1,43 @@
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { CLI_VERSION } from "../cli-version.js";
+import { SDK_MODULE, SDK_PACKAGE, sdkRequirement } from "../runtime/sdk-source.js";
+const minorLine = (version) => version.split(".").slice(0, 2).join(".");
+/**
+ * backend/go.mod names the App's SDK version; the frontend package and this
+ * CLI must agree with it. `needsSdk`: the App declares delegate or rootOps.
+ */
+export function sdkProblems(backendDir, frontendDir, needsSdk, cliVersion = CLI_VERSION) {
+    const version = sdkRequirement(backendDir);
+    if (!version) {
+        return needsSdk ? [{ code: "SDK_REQUIRED", message: `capabilities.delegate 與 rootOps 需要 SDK：在 backend/go.mod 加入 require ${SDK_MODULE} v${minorLine(cliVersion)}.x。` }] : [];
+    }
+    const problems = [];
+    if (minorLine(version) !== minorLine(cliVersion)) {
+        problems.push({ code: "SDK_UNSUPPORTED", message: `backend/go.mod 要求 SDK ${version}；CLI ${cliVersion} 只支援 SDK ${minorLine(cliVersion)}.x。請改用對應的 CLI，或把 SDK 升到 ${minorLine(cliVersion)}.x。` });
+    }
+    const frontend = frontendDir === undefined ? undefined : frontendSdkVersion(frontendDir);
+    if (frontend && frontend.version !== version) {
+        problems.push({ code: "SDK_VERSION_MISMATCH", message: `frontend/package.json 的 ${SDK_PACKAGE} 是 ${frontend.spec}（${frontend.version ?? "讀不到版本"}），backend/go.mod 要求 ${version}；兩者必須相同。` });
+    }
+    return problems;
+}
+/** The SDK the frontend depends on: a version, or a file: checkout read through its package.json. */
+function frontendSdkVersion(frontendDir) {
+    const pkg = readJson(join(frontendDir, "package.json"));
+    const spec = pkg?.dependencies?.[SDK_PACKAGE] ?? pkg?.devDependencies?.[SDK_PACKAGE];
+    if (typeof spec !== "string")
+        return undefined;
+    if (!spec.startsWith("file:"))
+        return { spec, version: spec };
+    const version = readJson(join(resolve(frontendDir, spec.slice("file:".length)), "package.json"))?.version;
+    return { spec, version: typeof version === "string" ? version : undefined };
+}
+function readJson(path) {
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/standalone/spk.js

@@ -84,7 +84,7 @@ export async function assembleStandaloneSpk(options) {
         }
         copyStandaloneNotices(manifest.root, manifest.ui.dir, join(staging, 'package'), manifest.backend.kind === 'go' || Boolean(manifest.daemon), manifest.backend.kind === 'go' ? manifest.backend.dir : undefined);
         if (manifest.daemon)
-            copyFileSync(new URL('../../templates/_shared/LICENSES/TEMPLATE.txt', import.meta.url), join(staging, 'package', 'LICENSES', 'DAEMON-LICENSE.txt'));
+            copyFileSync(new URL('../../assets/licenses/TEMPLATE.txt', import.meta.url), join(staging, 'package', 'LICENSES', 'DAEMON-LICENSE.txt'));
         const portal = nativePortal(manifest);
         if (portal) {
             writeFile(join(staging, "package", PORTAL_JSON_RELPATH), renderPortalJson(portal));

package/dist/template-paths.d.ts

@@ -1,2 +1,7 @@
-/** Both source execution and the published CLI resolve the same bundled templates. */
-export declare function templatesRoot(): string;
+/**
+ * The scaffold templates come from the exactly pinned @synopackageland/templates
+ * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
+ */
+export declare function templatesRoot(env?: NodeJS.ProcessEnv, from?: string): string;
+/** Go sources the CLI builds into every SPK that needs them; they are not scaffolded. */
+export declare function goAssetDir(name: "daemon" | "gateway"): string;

package/dist/template-paths.js

@@ -1,9 +1,21 @@
-import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-/** Both source execution and the published CLI resolve the same bundled templates. */
-export function templatesRoot() {
-    const moduleDir = dirname(fileURLToPath(import.meta.url));
-    const distTemplates = join(moduleDir, "templates");
-    return existsSync(distTemplates) ? distTemplates : join(moduleDir, "..", "templates");
+/**
+ * The scaffold templates come from the exactly pinned @synopackageland/templates
+ * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
+ */
+export function templatesRoot(env = process.env, from = import.meta.url) {
+    if (env.SYNOPKGLAND_TEMPLATES_DIR)
+        return join(env.SYNOPKGLAND_TEMPLATES_DIR, "templates");
+    try {
+        return join(dirname(createRequire(from).resolve("@synopackageland/templates/package.json")), "templates");
+    }
+    catch {
+        throw new Error("[TEMPLATES_MISSING] @synopackageland/templates is not installed; reinstall @synopackageland/cli, or set SYNOPKGLAND_TEMPLATES_DIR to a templates checkout.");
+    }
+}
+/** Go sources the CLI builds into every SPK that needs them; they are not scaffolded. */
+export function goAssetDir(name) {
+    return fileURLToPath(new URL(`../assets/go/${name}`, import.meta.url));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -13,16 +13,18 @@
     "dist",
     "assets",
     "CHANGELOG.md",
-    "templates",
     "schema",
     "skills"
   ],
   "scripts": {
-    "build": "rm -rf dist && tsc && node scripts/copy-templates.mjs",
+    "build": "rm -rf dist && tsc",
     "test": "npm run build && node --import tsx --test test/**/*.test.ts",
+    "test:scripts": "node --test scripts/test/release.test.mjs scripts/test/pack-docker.test.mjs scripts/test/npm-pack.test.mjs scripts/test/executor-bump.test.mjs",
+    "gates": "bash scripts/ci/gate.sh npm && bash scripts/ci/gate.sh native-go && bash scripts/ci/gate.sh daemon-gateway",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
+    "@synopackageland/templates": "0.9.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "tar": "^7.4.3",
@@ -38,6 +40,14 @@
     "registry": "https://registry.npmjs.org"
   },
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/synopackageland/syno-pkg-land-cli.git"
+  },
+  "homepage": "https://github.com/synopackageland/syno-pkg-land-cli#readme",
+  "bugs": {
+    "url": "https://github.com/synopackageland/syno-pkg-land-cli/issues"
+  },
   "exports": {
     "./authorization-sdk": "./dist/authorization-sdk.js",
     "./dist/*": "./dist/*",

package/dist/templates/_executor/README.md

@@ -1,318 +0,0 @@
-# Protected executor
-
-Standalone, standard-library-only Go module. Build with `CGO_ENABLED=0 GOOS=linux
-GOARCH=amd64|arm64 go build -trimpath -o executor .`. No network listener: the
-package account uses `/run/synopkgland/<package>/executor.sock` (one JSON line,
-including newline at most 65536 bytes). Socket access additionally requires exact
-Linux SO_PEERCRED UID equality, even for another member of the package group.
-Non-Linux builds support portable tests and refuse privileged service operations.
-
-Fixed writer children verify `no_new_privs` with `PR_GET_NO_NEW_PRIVS` on their
-locked Linux thread. DSM kernel 4.4 supports this flag but omits its proc status
-field; a failed syscall or a value other than one still refuses the write.
-Saved IDs and zero capabilities remain mandatory. The parent passes the pinned
-package-owned private source as a read-only FD; destination creation and publish
-remain under the subject UID, and source cleanup runs under the package UID.
-
-## Protected inventory and policy
-
-Setup must copy the INFO-anchored executor, policy-pinned policy and root scripts into:
-
-```
-/usr/local/etc/synopkgland/<package>/             root:root 0700
-  runtime/                                     root:root 0700
-    executor                                   root:root 0700
-    policy.json                                root:root 0600
-    tasks.json                                 root:root 0600 (verified setup task inventory)
-    root/<name>.sh                             root:root 0600
-  delegations/                                 root:root 0700
-    <random-256-bit-id>.json                    root:root 0600
-    executor.pid                               root:root 0600
-    executor.log                               root:root 0600 (control start)
-```
-
-The runtime location is mandatory; `control purge` removes this package's entire
-protected inventory after stopping it. The parent `/usr/local/etc/synopkgland`
-may be root:root 0755. Ancestors must be root-owned and not group/world writable;
-symlinks and writable runtime files are refused. Neither package-owned `etc` nor
-package `var` is trusted for executor code or delegation storage. The chosen path
-was measured on vt-nas DSM 7.4; survival of future DSM updates remains unverified.
-
-`policy.json` has this strict schema (no unknown keys):
-
-```json
-{
-  "v": 1,
-  "package": "com.example.downloader",
-  "app": "com.example.downloader.Application",
-  "scope": "home",
-  "operations": [
-    "status", "delegate.create", "delegate.list", "delegate.revoke",
-    "files.list", "files.info", "files.createFolder",
-    "files.checkPermission", "files.write", "root.run"
-  ],
-  "root": {"whoami": "<64 lowercase hexadecimal SHA-256 digits>"}
-}
-```
-
-`app` is the actual registered DSM AppPriv application ID, not a guessed package
-ID. DSM 7.x omits default-allowed Apps from AppPriv preview; an absent
-entry in a valid applications array is allowed. Explicit deny/custom, duplicate
-entries and malformed responses are refused. Account eligibility is rechecked
-independently, so absence never bypasses a disabled account. `scope` is the
-manifest's fixed `home` or `shared:<share-name>`; omit it for root-only packages.
-`operations` includes every permitted ID, including management and status IDs;
-no implicit allowlist exemptions. `root` is omitted when root operations are
-disabled. Only names in this digest map can execute. Setup pins policy bytes and
-all root scripts; no policy data comes from the package socket. The caller authentication pair follows the coordinator-approved v6 update to PLAN §2.4.
-
-## Requests
-
-Every request: `{"v":1,"op":"...","auth":{},"params":{...}}` followed by
-newline. `auth.dsm_cookie` is only the DSM `id` value, never a raw Cookie header.
-Caller requests also require `auth.dsm_synotoken`, forwarded from the current
-HTTP request's X-SYNO-TOKEN or SynoToken header. Both aliases may be present
-when their values match; conflicting aliases or repeated values of either header
-are refused. Local NormalUser verification
-sends both the id cookie and X-SYNO-TOKEN; neither value enters logs or storage.
-Only the executor's local DSM NormalUser HTTP result establishes identity. Other
-identity fields, duplicate JSON keys, invalid UTF-8, unrelated parameters, unknown
-operations and policy-excluded operations are rejected. Replies follow §2.4.
-
-| Operation | Parameters | Result |
-| --- | --- | --- |
-| status | none | executor_digest, policy_digest, version, ready, disabled |
-| delegate.create | job_id, ops[], scope, path, ttl_seconds | delegation_id, subject {username, uid}, expires_at (RFC3339) |
-| delegate.list | none | delegations[] with public metadata, including revoked/expired records |
-| delegate.revoke | delegation_id; job_id required without cookie | revoked |
-| files.list, files.info, files.checkPermission | delegation_id, job_id, path | DSM data object |
-| files.createFolder | delegation_id, job_id, path (parent), name | DSM data object |
-| files.write | delegation_id, job_id, staging (relative), dest_dir, name | path |
-| root.run | name | output (stdout and stderr combined) |
-
-Create/list require a cookie and SynoToken. Revoke accepts the subject/admin session pair or a matching
-package job ID. Root operations require the session pair independently verified as an
-active administrators member. Delegated operations recheck the account, UID,
-expired=`normal`, App and File Station privileges, scope,
-job, operation, expiry and revocation. UIDs below 1024 are excluded as system
-accounts. TTL must be 1–2592000 seconds. No cookie/SynoToken/SID/password is persisted.
-
-Paths use File Station spellings `/home[/...]` or `/<share>[/...]`. A delegation
-binds the requested directory's canonical path. Symlinks resolving outside that
-directory are denied. `files.write` opens package-owned, singly linked regular
-staging files with no symlink components; its fresh child checks setgroups,
-setresgid and setresuid in order, then real/effective/saved/filesystem IDs and groups, empty capability sets and
-`no_new_privs`. Admin users retain their own nonzero UID and current groups. The child
-opens the destination after dropping identity, verifies its pinned directory and
-scope, and copies into an exclusive hidden `.synopkgland-<job_id>-<random>.part`
-file. After fsync it publishes the complete file with a hard link, then removes
-the temporary name. Existing files and symlinks are never overwritten. The
-executor cleans the exact temporary name as the subject user after a canceled or
-killed child, using a retained directory descriptor; startup performs no scan.
-Successful writes request exact source cleanup in a separate package-UID child;
-cleanup failure retains the source and never downgrades a committed receipt. DSM ACL inheritance can
-produce a mode different from the requested 0600 (observed 0711 on vt-nas).
-
-File Station CheckPermission uses v3 with a fixed non-overwriting probe filename
-and size zero; it creates no file. Missing/failed API data is denied. DSM output
-and root script output are capped at 1 MiB; commands have 20-second deadlines,
-connection read/write deadlines are 15/5 seconds and request execution is bounded
-by 30 seconds. At most 16 connections are admitted. Legacy runner APIs use short
-admission leases; revoke/disable persist the fence then drain accepted legacy
-calls outside the commit lock before acknowledging. Bulk copy holds no commit
-lock. Linux command timeouts kill the entire command process group.
-
-File Station APIs resolve path strings inside DSM after executor scope validation;
-there is no atomic DSM API for binding that subsequent lookup to our directory
-FD. Concurrent subject-controlled directory renames remain a scope-race limitation
-for runner API operations. The writer uses pinned directory descriptors; a user
-can still move a directory after its final scope check. These are release review
-items, not assertions of complete race freedom.
-
-## Lifecycle and checks
-
-```
-executor serve --package com.example.downloader
-executor supervise --package com.example.downloader
-executor control start --package com.example.downloader
-executor control stop --package com.example.downloader
-executor control purge --package com.example.downloader
-```
-
-Root control start launches asynchronously; the caller reads socket status to
-establish readiness. It starts `executor supervise`, a root supervisor that runs
-`serve` as its child and restarts it after an abnormal end (signal or non-zero
-exit) with a 1 s backoff doubling to 60 s, reset after a minute of healthy run.
-A restarted `serve --revived` honors a `stop` already in the mailbox. Exit 0
-(root replacement, shutdown, purge), exit 3 (another monitor holds the pidfile)
-or a removed runtime end supervision. A held flock pidfile refuses duplicate
-serve. Root's pinned
-boot/control start can validate and terminate a previous monitor before launching
-its replacement; package-account start only writes the mailbox and cannot replace
-runtime. Stop pauses the listener while the monitor continues. Purge removes this
-package's protected state and deletes only its verified recorded scheduler tasks.
-
-Run `go test -race ./...` and `bash scripts/ci/gate.sh native-go`. The gate adds
-Linux amd64/arm64 vet, static binary builds and test compilation. Linux-specific
-syscall tests require a disposable Linux root fixture. This revision was tested
-on a Linux VM; DSM ACL, logout and reboot behavior remain unverified. The
-`testdata/live_probe.py` harness expects isolated disposable accounts and a
-manually copied runtime, reads passwords only from stdin, and logs no credentials.
-The live harness uses DSM's registered `SYNO.Desktop` AppPriv ID as a stand-in for
-an installed App; installed-package AppPriv integration belongs to setup testing.
-
-
-## Package lifecycle
-
-Package-account hooks atomically write `stop` before upgrades/stops, `start` on
-install/upgrade completion and package start, and `purge` before uninstall.
-`stop` cancels/drains requests and removes the listener without ending the root
-monitor. `start` resumes if both package executor and policy hashes equal the approved
-runtime pins. If only the executor changed, the policy hash is unchanged and the
-executor hash equals the single `synopkgland_executor_sha256` key in the
-root-owned `/var/packages/<package>/INFO`, the root monitor copies it into
-`runtime/`, verifies the copy and runs root `control start`, which replaces the
-monitor without reapproval. Any other change stays paused for administrator
-approval. Only root's pinned boot/control path or this anchored install can
-replace a monitor or runtime. To exercise this path on a NAS without a real
-executor change, the repository's `scripts/test/executor-bump.py` makes a
-build+1 SPK whose executor differs by one byte and rewrites the INFO anchor,
-`executor/setup.json` and the window script's embedded pins together.
-
-At start, scheduler readback must exactly match the canonical lifecycle scripts
-regenerated from the package identity and approved policy pin. Package
-setup metadata supplies hints only. The verified names, pins and script hashes
-are stored in root:root 0600 `runtime/tasks.json`. Purge regenerates the scripts
-and revalidates each current definition before EventScheduler v1
-delete (`task_name`) or TaskScheduler v2 delete (`tasks=[{id,real_owner}]`).
-Boot mirrors from TaskScheduler are ignored. Changed, missing, ambiguous or
-unverifiable records are logged and retained for administrator review; protected
-runtime, delegations and sockets are still removed, then the monitor exits.
-An absent process does not block uninstall; the pinned boot task handles pending
-purge or a missing package on the next boot. If the retained binary/policy is
-missing or tampered with, boot refuses execution and requires manual review.
-
-
-The separate package-account `executor/lifecycle` helper writes an atomic 0600
-mailbox request. Stop/purge wait at most 50 seconds for socket disappearance;
-start returns after writing and lets the monitor verify pins asynchronously.
-The helper never calls synowebapi or TaskScheduler. Socket inspection failures
-and timeouts warn and permit lifecycle to continue. Write/validation failures
-remain errors. Delegate hooks attempt worker stop first; a worker stop failure
-warns and still requests executor pause/purge.
-
-The monitor polls every 500 ms with bounded regular-file reads, accepting only
-exact start/stop/purge (optionally one trailing newline). Invalid values are
-ignored and logged without logging contents. The preuninst `purge` mailbox is
-handled immediately; cleanup completes asynchronously. Package directory/INFO
-identity absence is a fallback: the monitor pauses the socket and requests,
-retains runtime/delegations/tasks, and purges only after 10 continuous minutes of
-confirmed absence, even while paused. Every poll checks again; a valid identity
-resets the timer, and an unreadable path cannot count as confirmed absence.
-Reappearance re-reads the mailbox, including an unchanged `start`: matching pins
-resume, changed pins stay paused for administrator approval, `stop` stays paused,
-and `purge` clears state immediately. A root-approved new monitor ignores the
-stop file already present at startup; that exception ends after an absence.
-
-The boot task checks pending purge/package disappearance before accessing source.
-It verifies the retained policy pin before offline purge from the root-only
-runtime. Normal boot verifies the copies against the policy pin and the INFO
-executor anchor, installs them and calls root control start to replace a
-previous monitor. Scripts stay within 1 KiB with no percent characters, including the
-longest package name. Partial/tampered retained state requires administrator
-review. All nine uninstall wizard locales name the two tasks and disclose the
-retained DSM storage/infrastructure. `inspect`/`status` cleanup guidance is
-conditional; it does not claim that remote remnants were observed.
-
-Directories newly created by the executor are explicitly chowned/chmodded through
-a directory descriptor and verified with fstat, so boot umask 0077 cannot reduce
-/run/synopkgland 0755 or its package directory 0750. Existing directories are
-validated and never repaired/adopted. The package directory must already have
-root/package-group ownership. The socket is set to root/package-group 0660 and
-verified using Linux O_PATH + fstat on its filesystem inode.
-
-## Explicit long-running v1 extension
-
-The pinned policy opts in with top-level `destinations: ["save"]` and
-`lifetime: "until-revoked"`, together with `files.moveFromStaging` in the
-operation allowlist. Destination keys match `^[a-z][a-z0-9_-]{0,63}$`; unknown
-keys/lifetimes fail closed. Legacy policies/TTL grants never become permanent.
-The existing v1 envelope, peer UID check, protected runtime and session verifier
-remain unchanged. `root.run` is independent and is never a writer fallback.
-
-| Operation | Parameters | Result |
-| --- | --- | --- |
-| delegate.create (permanent) | scope, ops:[files.moveFromStaging], path, destination, lifetime:until-revoked | delegation_id, subject, path, destination, lifetime; zero expiry |
-| files.moveFromStaging | delegation_id, job_id, staging, name, size | job_id, state |
-| files.operationStatus | original delegation_id, job_id | job_id, state, optional code/receipt |
-| files.cancelOperation | original delegation_id, job_id | current operation state |
-| delegate.disable / delegate.enable | none; live administrator session | disabled |
-| delegate.audit | none; live owner/admin session | latest bounded events |
-
-Permanent create needs the current user's cookie and SynoToken and a successful
-File Station write check. The executor derives username/UID and exact directory
-identity itself. Permanent revoke is owner-bound even for administrators; admins
-can disable the entire package. Auth-less operation submission/status/cancel is
-for the trusted package producer holding the grant reference and original job ID.
-If credentials are supplied, both must verify and the owner must match; failed
-caller auth never falls back to offline authority. A compromised package backend
-can use all valid grants it holds, as documented in the approved trust model.
-
-Grants survive service restart in the protected store. The disabled flag also
-survives; mailbox start/boot never clears it. Disable persists first and revokes
-all legacy/permanent grants. Enable checks the live admin session and completes
-revocation before clearing the flag; it never restores old grants. Repeated enable
-while already enabled is a no-op.
-
-Operations are separate `operation-<sha256(job_id)>.record` files, root:root 0600.
-They bind immutable grant/job/staging/name/size and move through queued, copying,
-committed, canceled, interrupted or uncertain. Queued resumes without credentials;
-copying becomes interrupted on restart, or uncertain after durable publish intent.
-Neither state is replayed. Changed input for the same job is `operation-conflict`.
-Committed status alone includes `receipt:{path,size}`. Cleanup failures retain
-committed and add `CLEANUP_PENDING`. No same-name/hash guessing establishes receipt.
-
-Limits: 16 GiB per file, actual size+1 read, 16 queued, one active copy per package,
-24-hour attempt, 10 MiB operation metadata. Full journals reject new admissions;
-terminal records are retained to prevent replay. Bulk input bypasses job spools
-and the old 64 MiB wrapper limit. Long copies revalidate account/AppPriv/ACL/path
-with five-second polling and bounded checks; publish revalidates again. A failed
-identity/ACL/path check invalidates the grant and requires a new selection.
-
-The fixed child drops identity before opening the destination and creating any
-inode. Every component uses FD-relative O_NOFOLLOW; ancestors use O_PATH so only
-search rights are required. Source is package-owned, regular and singly linked;
-destination is the exact granted device/inode, never a caller-supplied path.
-Part metadata is durable before copying. Publish links the open part inode with
-no replacement, refusing files/symlinks/FIFOs at the final name. Revoke, disable
-and publish share the commit lock. Lost/malformed publish replies drain the child
-before releasing that lock and produce uncertain; a confirmed no-side-effect
-refusal such as `destination-exists` remains interrupted. The lock covers bounded
-publish handshake/fsync, never the bulk copy. During the copy the child watches
-its control pipe: if `serve` dies the pipe closes, so the child stops within one
-1 MiB chunk and unlinks its part (no `PR_SET_PDEATHSIG`, which the identity drop
-clears; works on kernel 3.10). Kernel-blocked filesystem I/O can
-still delay draining; it cannot be declared safely complete by a timeout.
-Legacy `files.write` uses this same child and publish handshake; the executor
-has no other writer, so no child can publish after `serve` is gone.
-
-Destination/part cleanup runs as the owner; source cleanup runs as package UID.
-Restart cleans only journaled exact part identity as the current eligible owner;
-changed/missing/inaccessible directories are retained for review, never scanned
-or deleted as root. Subject-controlled directory moves after the final check
-can still complete in the pinned directory object. DSM ACL changes and publication
-are not atomic, and silent UID/inode reuse is not universally detected. A subject
-who owns the destination can mutate its own output; this is not a content sandbox.
-
-Structured audit lives in protected `audit.jsonl`/`audit.previous`, at most 50 MiB
-combined, separate from authority. Events include package, username/UID, operation,
-job, location and result; no session credentials. Owner queries are filtered,
-admins can view this package's events. Replies contain at most 256 events/1 MiB.
-Admission events are labeled `admitting` because a subsequent durable write can
-fail. The operation journal, not an admission audit event, establishes completion.
-
-The existing status operation reads `Store.Disabled`; protected-store errors set
-`ready:false` rather than assuming enabled. Backend `delegate.status` exposes the
-verified boolean and `disabled` capability state. Backend `delegate.operations.list`
-is strictly empty-params, freshly owner/UID-filtered move-mirror metadata; it is
-not an executor operation. Live completion remains `files.operationStatus`.