@synopackageland/templates 0.27.0 → 0.28.0

package/README.md

@@ -22,8 +22,8 @@ daemon:
     window_seconds: 300
 ```
 
-Templates 0.27.0 inherit UI 0.14.9 from 0.26.5 and pin SDK 0.27.0 in native and Compose projects.
-Use CLI 0.27.0 or later. Go Apps select
+Templates pin UI 0.14.10 and SDK 0.28.0 in native and Compose projects.
+Use CLI 0.28.0 or later. Go Apps select
 their controller from their Go SDK requirement; an identity gateway selects it
 from `identity_gateway.sdk`. The CLI rejects older selected versions, even for
 an explicit `mode: off`, rather than dropping the declaration. A local SDK source
@@ -39,7 +39,7 @@ for declaration bounds, SDK selection, build/inspect checks and diagnostics.
 
 An opt-in [Shared Folder permission example](examples/shared-folder-permission/README.md)
 shows the Go status-handler registration and a Vue notice for startup checks and
-storage failures. It uses the same SDK 0.27.0 release pinned by the default scaffolds.
+storage failures. It uses the same SDK 0.28.0 release pinned by the default scaffolds.
 
 An opt-in [native UI plus DSM console example](examples/dual-entry-console/README.md)
 shows the `console` declaration for an App that wraps a web service behind the
@@ -49,7 +49,7 @@ identity gateway and keeps its own settings in an administrator-only DSM window.
 | --- | --- |
 | `native-go` | Base: `dsm-package.yaml`, Go module (`backend/cmd/{app,background-worker}`, `backend/internal/app`, `backend/internal/api/permissions.json`), plain `ui/`, i18n |
 | `native-go-vue` | Vue shell in `frontend/` (`App.vue`, `main.ts`, app i18n, `CapabilityPanels.vue`, `ExecutorGate.vue`) |
-| `native-go-jobs` | Background job routes in `internal/app` and their page test |
+| `native-go-jobs` | Background job routes in `internal/app` and a shell lifecycle test |
 | `native-go-delegate` | Delegate routes, the delegate background worker, the delegate `CapabilityPanels.vue` |
 | `native-go-root-ops` | The SDK's executor routes and `root.run` in `internal/app`, an example `root/whoami.sh`, and the Vue `ExecutorGate.vue` that holds the pages until the executor is approved |
 | `native-python` | Base: `dsm-package.yaml` (`backend.runtime: python`), the App in `backend/app` (`routes.py`, stub capability modules, `permissions.json`), unittest tests |
@@ -79,21 +79,19 @@ calls each one from the generated script of the same name (`synopkgland skill sh
 The placeholders `__PACKAGE__` (also the Go module path), `__DISPLAY_NAME__` and
 `__BACKGROUND_ENABLED__` are substituted by `init`.
 
-`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.27.0`; that line is
+`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.28.0`; that line is
 the single source of the SDK version and `frontend/package.json` pins
 `@synopackageland/sdk` to the same version. Python and Node.js name it in
 `backend.sdk`, Rust in the `syno-pkg-land-app` tag of `backend/Cargo.toml`
-(and `Cargo.lock`); all of them pin 0.27.0. The Vue frontend pins
-`@synopackageland/ui` 0.14.9. SDK 0.27.0 accepts UI `>=0.10.1 <0.15.0`,
+(and `Cargo.lock`); all of them pin 0.28.0. The Vue frontend pins
+`@synopackageland/ui` 0.14.10. SDK 0.28.0 accepts UI `>=0.10.1 <0.15.0`,
 so no UI peer override is needed. Tests use jsdom 30 for UI floating-layer styles.
 
 SDK 0.27.0 moves interactive NAS file operations to same-origin browser calls.
-The unused server-only `bg.browse` and file-import scaffold now return
-`unsupported`; custom file handlers need the SDK's
+Custom file handlers use the SDK's
 [session transport migration](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.27.0/docs/dsm-session-transport.md).
-Protected executor scaffolds need a released CLI with SDK 0.27.0 executor/lifecycle
-digests; CLI 0.26.0 does not include them and refuses those builds. Rebuilt protected
-executors follow normal administrator approval. No NAS acceptance is claimed.
+Use CLI 0.28.0 for the matching SDK 0.28.0 executor/lifecycle digests. Rebuilt
+protected executors follow normal administrator approval. No NAS acceptance is claimed.
 
 UI and i18n text, including the DSM glossary, omit terminal sentence periods.
 Keep punctuation between sentences and intentional loading ellipses.
@@ -215,12 +213,17 @@ visible while reads run. The backend permissions remain authoritative.
 
 Native Node Apps use the official [`Node.js_v22`](https://www.synology.com/en-us/dsm/packages/Node.js_v22) package. The official release history lists DSM 7 series; installation also depends on the model and DSM version supported by Package Center. This dependency does not certify all DSM 7 releases or install Node.js on unsupported models.
 
-### Temporarily disabled NAS hashing example
+### Background jobs
 
-SDK 0.27.0 no longer relays browser DSM sessions from a backend. This release
-explicitly disables the template NAS file hashing example: Go production
-`bg.browse`/`bg.jobs.submit` and bridge `hash.submit` return `unsupported` before
-reading a file or creating a job. The Vue background example page displays an
-unavailable notice. Existing job list/status/pause/resume/cancel/schedule APIs
-and workers remain available for App-owned input; no SDK API or special option
-is introduced. A safe browser-owned input flow is follow-up work.
+The jobs overlays submit files the App's own producer has already imported into
+its private data directory. Submit `{key, name, input}` through `bg.jobs.submit`
+(Go) or `hash.submit` (Python, Node.js and Rust); `input` is the absolute path of
+that App-owned file. The Go handler and the bridge runtime confine reads to the
+App data directory and keep the SDK's bounded private-copy input contract.
+There is no NAS browse/import example or automatic file submission in either UI shell.
+
+Keep the job controls and package-account workers for progress, cancellation and
+pause/resume. Existing Go schedule routes reprocess retained, successful job
+copies with explicit consent; they do not read a fresh source file on each run.
+The bridge examples expose submission, lookup and cancellation through
+`bg.submit`, `bg.get` and `bg.cancel`; the SDK's existing service surface is unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {

package/templates/_shared/AGENTS.md

@@ -110,9 +110,11 @@ may redistribute; never copy Synology's.
 
 ## Background jobs (`jobs`)
 
-The NAS hashing example is temporarily disabled pending browser-owned input
-migration. Do not use backend DSM session replay or `files.read` to restore it.
-Existing workers and job-control APIs remain available for App-owned input.
+Submit only files the App's own producer has already imported into its private
+data directory, with `{key, name, input}`. The existing worker processes a
+bounded private copy. Schedules reprocess that retained copy with explicit
+consent; they never reread a source file. Keep submission, progress and
+cancellation on the existing SDK contracts.
 
 The worker runs the App's Work for one claimed job at a time, as the package
 account. The Work receives the job's Task: it reads the private input copy,

package/templates/compose/dsm-package.yaml

@@ -14,7 +14,7 @@ compose:
   web: {service: web, port: 8080, health: {path: /, status: 200}}
   network: {egress: isolated}
 identity_gateway:
-  sdk: 0.27.0
+  sdk: 0.28.0
   mode: none
   listen: {http: 28000}
 # Web Apps default to new-page through the shared app-launch resolver.

package/templates/native-go/README.md

@@ -400,6 +400,13 @@ SDK's `docs/shared-folder.md` for the whole flow.
 | DSM | 7.1 or later declared (`os_min_ver`, change it with `init --min-dsm` or `build --min-dsm`). Installed and tested on DSM 7.4 and 7.3.2 (x86_64). armv7 was installed and tested on DSM 7.1.1 (`alpine4k`, Linux 3.10, where the bridge runs from the package tmp fallback) with administrator, AppPriv and unauthenticated requests; `armada38x` and `monaco` have not been run on a NAS. No x86_64 Linux 3.10 model has been tested. aarch64 SPKs are built the same way but have not been run on a NAS. |
 | Not supported | armv7 platforms only DSM 7.0/7.1 ship (`armada370`, `armada375`, `armadaxp`, `comcerto2k`); DSM 6, running anything as root without an administrator's approval |
 
-The NAS file hashing example is temporarily disabled pending browser-owned
-input migration. NAS import submission returns `unsupported` without reading a
-file or creating a job; existing worker and job-control APIs remain available.
+## Background job input
+
+Jobs process an existing file imported by the App's producer into its private
+data directory. The submission params are `{key, name, input}`: an idempotency
+key, a display name and an absolute path inside that directory. The SDK keeps a
+bounded private copy for the worker; no browser session or NAS picker is used.
+Submit with `bg.jobs.submit`; use `bg.jobs.get` for progress and
+`bg.jobs.cancel` to cancel. Pause/resume and existing schedule routes continue
+to operate on retained imported copies. Schedules require explicit consent and
+reprocess the fixed private copy, without rereading the source file.

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,6 @@
 Native Go package build dependencies
 
-github.com/synopackageland/syno-pkg-land-sdk v0.27.0 (MIT)
+github.com/synopackageland/syno-pkg-land-sdk v0.28.0 (MIT)
 
 Copyright (c) 2026 synopkgland
 

package/templates/native-go/backend/go.mod

@@ -4,6 +4,6 @@ go 1.25.0
 
 toolchain go1.26.10
 
-require github.com/synopackageland/syno-pkg-land-sdk v0.27.0
+require github.com/synopackageland/syno-pkg-land-sdk v0.28.0
 
 require golang.org/x/sys v0.44.0 // indirect

package/templates/native-go/backend/go.sum

@@ -1,4 +1,4 @@
-github.com/synopackageland/syno-pkg-land-sdk v0.27.0 h1:DyMQUEf6mIzEW2afdfGjWh5FM1R6qM6YW2LFD7/yZeI=
-github.com/synopackageland/syno-pkg-land-sdk v0.27.0/go.mod h1:8GwREGbczc8mAk4Gv8FUHaukXXCUstjzkovQrNV59Cc=
+github.com/synopackageland/syno-pkg-land-sdk v0.28.0 h1:54DolNgwneslNufx1ntvV6BYt/eDlk58TbeTKet/Ovg=
+github.com/synopackageland/syno-pkg-land-sdk v0.28.0/go.mod h1:8GwREGbczc8mAk4Gv8FUHaukXXCUstjzkovQrNV59Cc=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-go/backend/internal/app/background.go

@@ -4,16 +4,17 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"io"
 	"log"
 	"net/http"
+	"os"
 	"os/user"
-	"path"
 	"path/filepath"
+	"syscall"
 	"time"
 
 	"github.com/synopackageland/syno-pkg-land-sdk/api"
 	"github.com/synopackageland/syno-pkg-land-sdk/background"
-	"github.com/synopackageland/syno-pkg-land-sdk/filestation"
 )
 
 // workerFresh is how recent the worker heartbeat must be to count as running.
@@ -31,28 +32,20 @@ func osLookupUID(name string) string {
 	return u.Uid
 }
 
-type backgroundFiles interface {
-	Browse(ctx context.Context, c api.Caller, r *http.Request, folder string, offset int) (filestation.Page, error)
-	ReadFile(ctx context.Context, c api.Caller, r *http.Request, folder, rel string) ([]byte, error)
-}
-
 type backgroundAPI struct {
-	store *background.Store
-	files backgroundFiles
+	store   *background.Store
+	dataDir string
 }
 
-// BackgroundRoutes is the production assembly of the opt-in background jobs
-// API. The NAS hashing example is disabled until browser-owned input is wired.
-// Existing job control routes remain available. `synopkgland init --with jobs` wires it in through background.go's
-// replacement of background_none.go; nothing else references it.
+// BackgroundRoutes serves job controls for App-owned imported input.
 func BackgroundRoutes(dataDir string) []api.Route {
-	return newBackgroundRoutes(background.NewRequestStore(filepath.Join(dataDir, "background")), nil)
+	return newBackgroundRoutes(background.NewRequestStore(filepath.Join(dataDir, "background")), dataDir)
 }
 
 // Every request authenticates against DSM afresh. Owner routes are available
 // to signed-in users; schedule reapproval and owner cleanup are admin-only.
-func newBackgroundRoutes(store *background.Store, files backgroundFiles) []api.Route {
-	b := backgroundAPI{store: store, files: files}
+func newBackgroundRoutes(store *background.Store, dataDir string) []api.Route {
+	b := backgroundAPI{store: store, dataDir: dataDir}
 	return []api.Route{
 		api.HandleRequest("bg.status", b.owner(b.status)),
 		api.HandleRequest("bg.schedules.list", b.owner(b.schedules)),
@@ -61,7 +54,6 @@ func newBackgroundRoutes(store *background.Store, files backgroundFiles) []api.R
 		api.HandleRequest("bg.schedules.delete", b.owner(b.deleteSchedule)),
 		api.HandleRequest("bg.schedules.enable", b.admin(b.enableSchedule)),
 		api.HandleRequest("bg.jobs.purge", b.admin(b.purge)),
-		api.HandleRequest("bg.browse", b.owner(b.browse)),
 		api.HandleRequest("bg.jobs.submit", b.owner(b.submit)),
 		api.HandleRequest("bg.jobs.list", b.owner(b.list)),
 		api.HandleRequest("bg.jobs.get", b.owner(b.get)),
@@ -116,51 +108,28 @@ func workerAlive(w background.WorkerInfo, now time.Time) bool {
 	return now.Sub(w.At) <= workerFresh
 }
 
-// browse lists what the caller's own File Station session can see, so
-// the panel can pick a file instead of typing a path. It grants nothing:
-// submit still reads through the same session.
-func (b backgroundAPI) browse(ctx context.Context, c api.Caller, r *http.Request, params json.RawMessage) (any, error) {
-	var in struct {
-		Folder string `json:"folder"`
-		Offset int    `json:"offset"`
-	}
-	if err := decodeParams(params, &in); err != nil {
-		return nil, err
-	}
-	if in.Offset < 0 {
-		return nil, api.BadRequest("offset must not be negative")
-	}
-	if b.files == nil {
-		return nil, &api.Error{Code: "unsupported", Message: "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available."}
-	}
-	return b.files.Browse(ctx, c, r, in.Folder, in.Offset)
-}
-
-func (b backgroundAPI) submit(ctx context.Context, c api.Caller, r *http.Request, params json.RawMessage) (any, error) {
+func (b backgroundAPI) submit(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
 	var in struct {
-		Key      string `json:"key"`
-		Folder   string `json:"folder"`
-		Relative string `json:"relative"`
+		Key   string `json:"key"`
+		Name  string `json:"name"`
+		Input string `json:"input"`
 	}
 	if err := decodeParams(params, &in); err != nil {
 		return nil, err
 	}
-	if in.Key == "" || in.Folder == "" || in.Relative == "" {
-		return nil, api.BadRequest("key, folder and relative are required")
+	if in.Key == "" || in.Name == "" || in.Input == "" {
+		return nil, api.BadRequest("key, name and input are required")
 	}
 	access := accessFrom(ctx)
 	if !access.Owner.Valid() {
 		return nil, &api.Error{Code: "identity_unavailable", Message: "DSM user UID could not be resolved"}
 	}
-	if b.files == nil {
-		return nil, &api.Error{Code: "unsupported", Message: "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available."}
-	}
-	data, err := b.files.ReadFile(ctx, c, r, in.Folder, in.Relative)
+	data, err := b.readInput(in.Input)
 	if err != nil {
 		return nil, err
 	}
 	job, duplicate, err := b.store.Submit(ctx, background.SubmitRequest{
-		Key: in.Key, Name: path.Base(in.Relative), Data: data, Submitter: access.Owner,
+		Key: in.Key, Name: in.Name, Data: data, Submitter: access.Owner,
 	})
 	if err != nil {
 		return nil, backgroundError(err)
@@ -168,6 +137,41 @@ func (b backgroundAPI) submit(ctx context.Context, c api.Caller, r *http.Request
 	return map[string]any{"job": job, "duplicate": duplicate}, nil
 }
 
+// readInput accepts only an existing regular file inside the App data directory.
+// The App's producer imports it first; jobs and schedules retain a private copy.
+func (b backgroundAPI) readInput(input string) ([]byte, error) {
+	bad := api.BadRequest("input must be a regular file in the App data directory")
+	rel, err := filepath.Rel(b.dataDir, input)
+	if err != nil || !filepath.IsAbs(input) || !filepath.IsLocal(rel) {
+		return nil, bad
+	}
+	root, err := os.OpenRoot(b.dataDir)
+	if err != nil {
+		return nil, bad
+	}
+	defer root.Close()
+	f, err := root.OpenFile(rel, os.O_RDONLY|syscall.O_NONBLOCK, 0)
+	if err != nil {
+		return nil, bad
+	}
+	defer f.Close()
+	info, err := f.Stat()
+	if err != nil || !info.Mode().IsRegular() {
+		return nil, bad
+	}
+	if info.Size() > background.MaxInputBytes {
+		return nil, backgroundError(background.ErrTooLarge)
+	}
+	data, err := io.ReadAll(io.LimitReader(f, background.MaxInputBytes+1))
+	if err != nil {
+		return nil, bad
+	}
+	if len(data) > background.MaxInputBytes {
+		return nil, backgroundError(background.ErrTooLarge)
+	}
+	return data, nil
+}
+
 func (b backgroundAPI) list(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
 	if err := decodeParams(params, &struct{}{}); err != nil {
 		return nil, err

package/templates/native-go/backend/internal/app/background_owner_test.go

@@ -28,7 +28,7 @@ var carol = stubAuth{identity: api.Identity{User: "carol"}}
 
 func ownerSubmit(t *testing.T, e *bgEnv, a api.Authenticator, key string) string {
 	t.Helper()
-	code, out := e.call(a, "bg.jobs.submit", `{"key":"`+key+`","folder":"/share","relative":"a.txt"}`)
+	code, out := e.call(a, "bg.jobs.submit", e.submitParams(key))
 	if code != "" {
 		t.Fatalf("submit %s: %s %v", key, code, out)
 	}
@@ -103,7 +103,7 @@ func TestBackgroundPersonalQuotaAndAdminPurge(t *testing.T) {
 	}
 	ownerSubmit(t, e, bob, "one")
 	ownerSubmit(t, e, bob, "two")
-	if code, _ := e.call(bob, "bg.jobs.submit", `{"key":"three","folder":"/share","relative":"a.txt"}`); code != "owner-queue-full" {
+	if code, _ := e.call(bob, "bg.jobs.submit", e.submitParams("three")); code != "owner-queue-full" {
 		t.Fatal(code)
 	}
 	ownerSubmit(t, e, carol, "one")

package/templates/native-go/backend/internal/app/background_schedule_test.go

@@ -55,8 +55,4 @@ func TestBackgroundScheduleRoutesConsentOwnerAndAdmin(t *testing.T) {
 	if code, _ := e.call(bob, "bg.schedules.delete", fmt.Sprintf(`{"id":%q}`, sid)); code != "" {
 		t.Fatal(code)
 	}
-	// No scheduling route calls File Station, uses a root grant or stores a session.
-	if e.files.calls != 1 {
-		t.Fatalf("schedule read File Station %d", e.files.calls)
-	}
 }

package/templates/native-go/backend/internal/app/background_test.go

@@ -14,50 +14,30 @@ import (
 
 	"github.com/synopackageland/syno-pkg-land-sdk/api"
 	"github.com/synopackageland/syno-pkg-land-sdk/background"
-	"github.com/synopackageland/syno-pkg-land-sdk/filestation"
 )
 
-type fakeFiles struct {
-	data   []byte
-	err    error
-	calls  int
-	folder string
-	rel    string
-	offset int
-	page   filestation.Page
-}
-
-func (f *fakeFiles) Browse(_ context.Context, _ api.Caller, _ *http.Request, folder string, offset int) (filestation.Page, error) {
-	f.calls++
-	f.folder, f.offset = folder, offset
-	return f.page, f.err
-}
-
-func (f *fakeFiles) ReadFile(_ context.Context, _ api.Caller, _ *http.Request, folder, rel string) ([]byte, error) {
-	f.calls++
-	f.folder, f.rel = folder, rel
-	return f.data, f.err
-}
-
 type bgEnv struct {
-	t     *testing.T
-	store *background.Store
-	files *fakeFiles
-	srv   map[string]*api.Server
+	t       *testing.T
+	store   *background.Store
+	dataDir string
+	srv     map[string]*api.Server
 }
 
 func newBgEnv(t *testing.T) *bgEnv {
 	lookupSubmitterUID = func(string) string { return "1024" }
 	t.Cleanup(func() { lookupSubmitterUID = osLookupUID })
-	store := background.NewStore(filepath.Join(t.TempDir(), "background"))
-	files := &fakeFiles{data: []byte("hello")}
-	return &bgEnv{t: t, store: store, files: files, srv: map[string]*api.Server{}}
+	dir := t.TempDir()
+	store := background.NewStore(filepath.Join(dir, "background"))
+	if err := os.WriteFile(filepath.Join(dir, "input.txt"), []byte("hello"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	return &bgEnv{t: t, store: store, dataDir: dir, srv: map[string]*api.Server{}}
 }
 
 func (e *bgEnv) call(auth api.Authenticator, method, params string) (string, map[string]any) {
 	e.t.Helper()
 	// SDK policy provides owner routes immediately.
-	routes := newBackgroundRoutes(e.store, e.files)
+	routes := newBackgroundRoutes(e.store, e.dataDir)
 	srv, err := api.NewServerWithPermissions(auth, []byte(`{"schema":1,"default":"administrators","methods":{}}`), routes...)
 	if err != nil {
 		e.t.Fatal(err)
@@ -88,8 +68,7 @@ var bgSample = map[string]string{
 	"bg.schedules.enable":  `{"id":"missing","consent":true}`,
 	"bg.status":            `{}`,
 	"bg.jobs.purge":        `{"owner":{"user":"bob","uid":"1025"}}`,
-	"bg.browse":            `{"folder":"/share","offset":0}`,
-	"bg.jobs.submit":       `{"key":"k1","folder":"/share","relative":"a.txt"}`,
+	"bg.jobs.submit":       `{"key":"k1","name":"a.txt","input":"/missing"}`,
 	"bg.jobs.list":         `{}`,
 	"bg.jobs.get":          `{"id":"` + strings.Repeat("a", 32) + `"}`,
 	"bg.jobs.cancel":       `{"id":"` + strings.Repeat("a", 32) + `"}`,
@@ -100,7 +79,7 @@ var bgSample = map[string]string{
 
 func TestBackgroundSDKPoliciesAuthenticateEveryRoute(t *testing.T) {
 	e := newBgEnv(t)
-	routes := newBackgroundRoutes(e.store, e.files)
+	routes := newBackgroundRoutes(e.store, e.dataDir)
 	if len(routes) != len(bgSample) {
 		t.Fatalf("%d routes, %d samples", len(routes), len(bgSample))
 	}
@@ -149,55 +128,73 @@ func TestBackgroundStatusReportsLimitsAndWorker(t *testing.T) {
 	}
 }
 
-func TestBackgroundSubmitAvailableOnFreshStore(t *testing.T) {
-	e := newBgEnv(t)
-	code, _ := e.call(alice, "bg.jobs.submit", bgSample["bg.jobs.submit"])
-	if code != "" || e.files.calls != 1 {
-		t.Fatalf("%q, NAS reads %d", code, e.files.calls)
+func (e *bgEnv) submitParams(key string) string {
+	p, err := json.Marshal(map[string]string{"key": key, "name": "a.txt", "input": filepath.Join(e.dataDir, "input.txt")})
+	if err != nil {
+		e.t.Fatal(err)
 	}
+	return string(p)
 }
 
-func TestBackgroundSubmitImportsSelectedFileAndIsIdempotent(t *testing.T) {
+func TestBackgroundSubmitImportsAppInputAndIsIdempotent(t *testing.T) {
 	e := newBgEnv(t)
-	params := `{"key":"k1","folder":"/share","relative":"docs/a.txt"}`
+	params := e.submitParams("k1")
 	code, out := e.call(alice, "bg.jobs.submit", params)
-	job := data(out)["job"].(map[string]any)
-	if code != "" || job["state"] != "queued" || job["name"] != "a.txt" || data(out)["duplicate"] != false {
+	if code != "" {
 		t.Fatalf("%s %v", code, out)
 	}
-	if e.files.folder != "/share" || e.files.rel != "docs/a.txt" {
-		t.Fatalf("adapter saw %q %q", e.files.folder, e.files.rel)
+	job := data(out)["job"].(map[string]any)
+	if job["state"] != "queued" || job["name"] != "a.txt" || data(out)["duplicate"] != false {
+		t.Fatal(out)
 	}
 	submitter := job["submitter"].(map[string]any)
 	if submitter["user"] != "alice" || submitter["uid"] != "1024" {
-		t.Fatalf("submitter: %v", submitter)
+		t.Fatal(submitter)
 	}
 	_, again := e.call(alice, "bg.jobs.submit", params)
 	if data(again)["duplicate"] != true || data(again)["job"].(map[string]any)["id"] != job["id"] {
-		t.Fatalf("duplicate: %v", again)
+		t.Fatal(again)
+	}
+	if err := os.WriteFile(filepath.Join(e.dataDir, "input.txt"), []byte("other"), 0600); err != nil {
+		t.Fatal(err)
 	}
-	e.files.data = []byte("other")
 	if code, _ := e.call(alice, "bg.jobs.submit", params); code != "conflict" {
-		t.Fatalf("same key with different bytes: %q", code)
+		t.Fatalf("different bytes: %q", code)
 	}
 }
 
-func TestBackgroundSubmitPassesAdapterRefusalsThrough(t *testing.T) {
+func TestBackgroundSubmitRejectsExternalAndOversizedInput(t *testing.T) {
 	e := newBgEnv(t)
-	e.files.err = &api.Error{Code: "limit-exceeded", Message: "x"}
-	if code, _ := e.call(alice, "bg.jobs.submit", bgSample["bg.jobs.submit"]); code != "limit-exceeded" {
-		t.Fatalf("%q", code)
+	outside := filepath.Join(t.TempDir(), "outside")
+	if err := os.WriteFile(outside, []byte("private"), 0600); err != nil {
+		t.Fatal(err)
 	}
-	if jobs, _ := e.store.List(context.Background()); len(jobs) != 0 {
-		t.Fatal("a failed import must never enter the queue")
+	if err := os.Symlink(outside, filepath.Join(e.dataDir, "escape")); err != nil {
+		t.Fatal(err)
+	}
+	for _, input := range []string{outside, "input.txt", filepath.Join(e.dataDir, "escape"), e.dataDir} {
+		p, _ := json.Marshal(map[string]string{"key": "bad", "name": "a.txt", "input": input})
+		if code, _ := e.call(alice, "bg.jobs.submit", string(p)); code != "bad_request" {
+			t.Fatalf("%s: %s", input, code)
+		}
+	}
+	if err := os.WriteFile(filepath.Join(e.dataDir, "input.txt"), make([]byte, background.MaxInputBytes+1), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if code, _ := e.call(alice, "bg.jobs.submit", e.submitParams("big")); code != "limit-exceeded" {
+		t.Fatal(code)
+	}
+	jobs, err := e.store.List(context.Background())
+	if err != nil || len(jobs) != 0 {
+		t.Fatalf("invalid input queued: %v %v", jobs, err)
 	}
 }
 
 func TestBackgroundSubmitValidatesParams(t *testing.T) {
 	e := newBgEnv(t)
 	for _, p := range []string{
-		`{}`, `{"key":"k","folder":"/share","relative":"a","extra":1}`, `{"key":"bad key","folder":"/share","relative":"a"}`,
-		`{"key":"k","folder":"/share","relative":""}`,
+		`{}`, `{"key":"k","name":"a","input":"/a","extra":1}`, e.submitParams("bad key"),
+		`{"key":"k","name":"a","input":""}`,
 	} {
 		if code, _ := e.call(alice, "bg.jobs.submit", p); code != "bad_request" {
 			t.Errorf("%s: %q", p, code)
@@ -210,19 +207,19 @@ func TestBackgroundQueueFullAndQuotaErrorsHaveStableCodes(t *testing.T) {
 	for i := 0; i < background.MaxQueued; i++ {
 		lookupSubmitterUID = func(string) string { return fmt.Sprint(1024 + i/2) }
 		key := "k" + string(rune('a'+i))
-		if code, _ := e.call(alice, "bg.jobs.submit", `{"key":"`+key+`","folder":"/share","relative":"a.txt"}`); code != "" {
+		if code, _ := e.call(alice, "bg.jobs.submit", e.submitParams(key)); code != "" {
 			t.Fatalf("%d: %q", i, code)
 		}
 	}
 	lookupSubmitterUID = func(string) string { return "9999" }
-	if code, _ := e.call(alice, "bg.jobs.submit", `{"key":"more","folder":"/share","relative":"a.txt"}`); code != "queue-full" {
+	if code, _ := e.call(alice, "bg.jobs.submit", e.submitParams("more")); code != "queue-full" {
 		t.Fatalf("%q", code)
 	}
 }
 
 func TestBackgroundListGetCancelAndResult(t *testing.T) {
 	e := newBgEnv(t)
-	_, out := e.call(alice, "bg.jobs.submit", `{"key":"k1","folder":"/share","relative":"a.txt"}`)
+	_, out := e.call(alice, "bg.jobs.submit", e.submitParams("k1"))
 	id := data(out)["job"].(map[string]any)["id"].(string)
 	idp := `{"id":"` + id + `"}`
 
@@ -260,7 +257,7 @@ func TestBackgroundListGetCancelAndResult(t *testing.T) {
 
 func TestBackgroundCancelQueuedJob(t *testing.T) {
 	e := newBgEnv(t)
-	_, out := e.call(alice, "bg.jobs.submit", `{"key":"k1","folder":"/share","relative":"a.txt"}`)
+	_, out := e.call(alice, "bg.jobs.submit", e.submitParams("k1"))
 	id := data(out)["job"].(map[string]any)["id"].(string)
 	code, out := e.call(alice, "bg.jobs.cancel", `{"id":"`+id+`"}`)
 	if code != "" || data(out)["job"].(map[string]any)["state"] != "canceled" {
@@ -270,7 +267,7 @@ func TestBackgroundCancelQueuedJob(t *testing.T) {
 
 func TestBackgroundPauseAndResumeQueuedJob(t *testing.T) {
 	e := newBgEnv(t)
-	_, out := e.call(alice, "bg.jobs.submit", `{"key":"k1","folder":"/share","relative":"a.txt"}`)
+	_, out := e.call(alice, "bg.jobs.submit", e.submitParams("k1"))
 	idp := `{"id":"` + data(out)["job"].(map[string]any)["id"].(string) + `"}`
 	for method, state := range map[string]string{"bg.jobs.pause": "paused", "bg.jobs.resume": "queued"} {
 		if code, out := e.call(alice, method, idp); code != "" || data(out)["job"].(map[string]any)["state"] != state {
@@ -296,48 +293,6 @@ func TestBackgroundWorkerAliveExpires(t *testing.T) {
 	}
 }
 
-func TestBackgroundBrowseListsThroughTheCallersSession(t *testing.T) {
-	e := newBgEnv(t)
-	e.files.page = filestation.Page{Files: []filestation.Entry{{Name: "a.txt", Path: "/share/a.txt"}}, Total: 1}
-	code, out := e.call(alice, "bg.browse", `{"folder":"/share","offset":100}`)
-	if code != "" {
-		t.Fatalf("%s %v", code, out)
-	}
-	if e.files.folder != "/share" || e.files.offset != 100 {
-		t.Fatalf("browsed %q at %d", e.files.folder, e.files.offset)
-	}
-	files := data(out)["files"].([]any)
-	if len(files) != 1 || files[0].(map[string]any)["path"] != "/share/a.txt" {
-		t.Fatalf("page %v", out)
-	}
-}
-
-func TestBackgroundBrowseWithoutFolderListsTheShares(t *testing.T) {
-	e := newBgEnv(t)
-	if code, out := e.call(alice, "bg.browse", `{}`); code != "" {
-		t.Fatalf("%s %v", code, out)
-	}
-	if e.files.folder != "" || e.files.offset != 0 {
-		t.Fatalf("browsed %q at %d", e.files.folder, e.files.offset)
-	}
-}
-
-func TestBackgroundBrowseValidatesParamsAndPassesRefusalsThrough(t *testing.T) {
-	e := newBgEnv(t)
-	for _, params := range []string{`{"offset":-1}`, `{"folder":"/share","extra":1}`, `{"offset":"1"}`} {
-		if code, _ := e.call(alice, "bg.browse", params); code != "bad_request" {
-			t.Errorf("%s: %q", params, code)
-		}
-	}
-	if e.files.calls != 0 {
-		t.Fatal("invalid params must not reach the NAS")
-	}
-	e.files.err = &api.Error{Code: "denied", Message: "no"}
-	if code, _ := e.call(alice, "bg.browse", `{"folder":"/share"}`); code != "denied" {
-		t.Fatalf("got %q", code)
-	}
-}
-
 func TestBackgroundListWithoutJobsIsAnEmptyArray(t *testing.T) {
 	e := newBgEnv(t)
 	_, out := e.call(alice, "bg.jobs.list", `{}`)

package/templates/native-go-delegate/frontend/src/CapabilityPanels.vue

@@ -30,5 +30,8 @@ onBeforeUnmount(()=>{disposed=true;provider.dispose()})
  <BackgroundSavePanel v-if="mode==='long'" ref="panel" :key="revision" :sdk="sdk" :admin="admin" :locale="ctx.locale" :picker="{provider,keys}" sample-save />
  <DelegatePanel v-else-if="mode==='legacy'" ref="panel" :ctx="ctx" />
  <SectionSkeleton v-else-if="mode==='loading'" />
- <Callout v-else tone="danger" role="alert">{{ copy.error }} <Button variant="secondary" @click="detect">{{ copy.retry }}</Button></Callout>
+ <Callout v-else tone="danger" role="alert">
+  {{ copy.error }}
+  <template #actions><Button variant="secondary" @click="detect">{{ copy.retry }}</Button></template>
+ </Callout>
 </template>