@synopackageland/templates 0.35.5 → 0.37.0

package/README.md

@@ -22,8 +22,8 @@ daemon:
     window_seconds: 300
 ```
 
-Templates 0.35.3 pin UI 0.16.1 and SDK 0.38.2 in native and Compose projects.
-Use CLI 0.41.2. The Vue `AppShell` shows a
+Templates 0.37.0 pin UI 0.19.1 and SDK 0.41.1 in native and Compose projects.
+Use a CLI that supports executor manifest format 1. The Vue `AppShell` shows a
 non-blocking **Reload** notice when an upgrade replaced the UI an open page
 loaded. Go Apps select
 their controller from their Go SDK requirement; an identity gateway selects it
@@ -33,8 +33,9 @@ override does not waive that version check.
 
 The SDK owns backoff, the sliding retry cap and stop cancellation. Keep existing
 stop-before-upgrade/uninstall hooks; do not add retry loops in App scripts.
-Clean exits do not restart; initial startup retains its original fail-fast
-deadline. Compose keeps its own supervision. An App backend may map SDK
+Clean exits do not restart; failures before the first successful startup use
+the same bounded recovery policy as later exits. Compose keeps its own supervision.
+An App backend may map SDK
 `status-json` state/reason to its authenticated status UI; no new status panel is
 generated. See the CLI's [daemon policy guide](https://github.com/synopackageland/syno-pkg-land-cli/blob/main/docs/daemon.md)
 for declaration bounds, SDK selection, build/inspect checks and diagnostics.
@@ -81,20 +82,21 @@ calls each one from the generated script of the same name (`synopkgland skill sh
 The placeholders `__PACKAGE__` (also the Go module path), `__DISPLAY_NAME__` and
 `__BACKGROUND_ENABLED__` are substituted by `init`.
 
-`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.38.2`; that line is
+`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.41.1`; that line is
 the single source of the SDK version and `frontend/package.json` pins
 `@synopackageland/sdk` to the same version. Python and Node.js name it in
 `backend.sdk`, Rust in the `syno-pkg-land-app` tag of `backend/Cargo.toml`
-(and `Cargo.lock`); all of them pin 0.38.2. The Vue frontend pins
-`@synopackageland/ui` 0.16.1. SDK 0.38.2 accepts UI `>=0.10.1 <0.18.0`,
+(and `Cargo.lock`); all of them pin 0.41.1. The Vue frontend pins
+`@synopackageland/ui` 0.19.1. SDK 0.41.1 accepts UI `>=0.10.1 <0.20.0`,
 so no UI peer override is needed. Tests use jsdom 30 for UI floating-layer styles.
 
 Interactive NAS file operations use same-origin browser calls.
 Custom file handlers use the SDK's
-[session transport migration](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.2/docs/dsm-session-transport.md).
-CLI 0.41.5 reads SDK 0.38.2's release manifest, which names immutable
-executor/v0.38.2 and its executor digests. Its `~0.35.3` templates
-dependency selects this release.
+[session transport migration](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.41.1/docs/dsm-session-transport.md).
+The CLI reads SDK 0.41.1's release manifest, which names immutable
+executor/v0.39.0 and its executor digests. CLI distributions must resolve
+templates 0.37.x before default scaffolds use this release; a `~0.36.0`
+templates dependency remains on the older minor.
 
 Every App method must appear in the permissions table, including methods whose
 permission equals `default: administrators`. Dynamic method names and custom
@@ -108,7 +110,7 @@ Keep punctuation between sentences and intentional loading ellipses.
 
 ## Request deadlines and background work
 
-SDK/App 0.38.2 defaults to 300 seconds for cooperative requests and 302 seconds
+SDK/App 0.41.1 defaults to 300 seconds for cooperative requests and 302 seconds
 for the TS client and generated DSM window. The CLI reads the selected SDK's
 timeout spec; `backend.timeout_seconds` explicitly overrides it for native
 backends, and an earlier parent deadline still wins. Go assembly should fall
@@ -140,7 +142,7 @@ caps, approved root policy/program budgets and credential lifetimes retain
 their existing limits; long root work uses `root.start` / `root.jobs.*`.
 The independent ctl transport keeps its 62-second default: use an explicit
 `--timeout` for long synchronous calls, or an existing nonblocking job flow.
-See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.2/docs/request-deadlines.md).
+See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.41.1/docs/request-deadlines.md).
 
 ## Hyper Backup
 
@@ -286,9 +288,12 @@ Native Node Apps use the official [`Node.js_v22`](https://www.synology.com/en-us
 
 The jobs overlays submit files the App's own producer has already imported into
 its private data directory. Submit `{key, name, input}` through `bg.jobs.submit`
-(Go) or `hash.submit` (Python, Node.js and Rust); `input` is the absolute path of
-that App-owned file. The Go handler and the bridge runtime confine reads to the
-App data directory and keep the SDK's bounded private-copy input contract.
+(Go) or `hash.submit` (Python, Node.js and Rust). In Go, a trusted producer writes
+into `BackgroundInbox(dataDir, background.Submitter{User: verifiedName, UID: verifiedUID})`;
+`input` must be an absolute path inside that exact owner's inbox, including for
+administrators. The name and UID both scope the inbox, so a recreated account
+gets another directory. Symlinks cannot escape it. Jobs and schedules retain a
+bounded private copy. Bridge-language job producers retain their SDK input contract.
 There is no NAS browse/import example or automatic file submission in either UI shell.
 
 Keep the job controls and package-account workers for progress, cancellation and
@@ -299,7 +304,7 @@ The bridge examples expose submission, lookup and cancellation through
 
 ## External access
 
-With CLI 0.40.0 and SDK 0.38.2, a gateway App may declare `identity_gateway.external_access: {connect: optional, origin_change: confirm, single_origin: true}` for an upstream that signs in on one fixed URL. The policy is forwarded to the packaged gateway. A single-origin App's `manual_origin` accepts an explicit HTTPS port; the `external-origin` installation setting remains restricted to port 443. The DSM launcher selects a provider destination, probes `/_spl/ping` for up to eight seconds, and explains failures before offering **Open anyway**. A configured single-origin App always opens its primary external origin.
+With a compatible CLI and SDK 0.41.1, a gateway App may declare `identity_gateway.external_access: {connect: optional, origin_change: confirm, single_origin: true}` for an upstream that signs in on one fixed URL. The policy is forwarded to the packaged gateway. A single-origin App's `manual_origin` accepts an explicit HTTPS port; the `external-origin` installation setting remains restricted to port 443. The DSM launcher selects a provider destination, probes `/_spl/ping` for up to eight seconds, and explains failures before offering **Open anyway**. A configured single-origin App always opens its primary external origin.
 
 
 Compose templates declare an app-named dedicated shared folder by default. DSM
@@ -332,3 +337,15 @@ marker with their own. Use `entry` only for a configured entry override. An
 entry declared upstream-authenticated in the manifest also needs `publicLogin`
 to identify its own login page. A DSM-gated entry cannot opt out of the gate.
 This smoke checks opening only; it does not install packages or change accounts.
+
+
+The delegate report example scopes staging to
+`owners/<sha256(username + NUL + delegationID)>/` and scopes its executor job ID
+to SHA-256 of username, NUL, delegation ID, NUL and its producer job ID, followed
+by a hyphen and the first 32 hex characters of the owner hash. The SDK verifies
+this owner-and-grant suffix on admission. Repeated
+saves by the same owner and grant reuse their original file; other owners and
+grants get different sources. A newly created report refused with
+`DELEGATION_DENIED` is removed. An ambiguous transport failure keeps the source
+for retry because the executor may already have admitted it. Other settled
+sources use the SDK's explicit discard operation when the App deletes the job.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.35.5",
+  "version": "0.37.0",
   "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {

package/templates/compose/dsm-package.yaml

@@ -23,7 +23,7 @@ compose:
   web: {service: web, port: 8080, health: {path: /, status: 200}}
   network: {egress: isolated}
 identity_gateway:
-  sdk: 0.38.2
+  sdk: 0.41.1
   mode: none
   listen: {http: 28000}
 # Web Apps default to new-page through the shared app-launch resolver.

package/templates/native-go/README.md

@@ -17,7 +17,7 @@ DSM main menu → DSM window (ui/app.js)
 
 ## Requests and long work
 
-SDK/App 0.38.2 defaults to 300-second requests and a 302-second browser wait.
+SDK/App 0.41.1 defaults to 300-second requests and a 302-second browser wait.
 Explicit `backend.timeout_seconds` and earlier parent deadlines still apply;
 rebuild the App to use the new SDK. For long NAS work, enable the existing jobs
 capability: return admission and the original job ID promptly, execute in the
@@ -27,7 +27,7 @@ last queued/running state intact. After a lost admission reply, reuse the same
 idempotency key and input instead of replaying a mutation with a new key.
 Jobs default to 30 minutes; approved executor limits remain separate. ctl keeps
 its 62-second transport default; use an explicit `--timeout` or an existing
-nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.2/docs/request-deadlines.md).
+nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.41.1/docs/request-deadlines.md).
 
 ## Quick start
 

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,6 @@
 Native Go package build dependencies
 
-github.com/synopackageland/syno-pkg-land-sdk v0.38.2 (MIT)
+github.com/synopackageland/syno-pkg-land-sdk v0.41.1 (MIT)
 
 Copyright (c) 2026 synopkgland
 

package/templates/native-go/backend/go.mod

@@ -4,6 +4,6 @@ go 1.25.0
 
 toolchain go1.26.10
 
-require github.com/synopackageland/syno-pkg-land-sdk v0.38.2
+require github.com/synopackageland/syno-pkg-land-sdk v0.41.1
 
 require golang.org/x/sys v0.44.0 // indirect

package/templates/native-go/backend/go.sum

@@ -1,4 +1,4 @@
-github.com/synopackageland/syno-pkg-land-sdk v0.38.2 h1:UJh6tbUxhmcRdy8Y6qqJYHcxZtYkShE9UxtXjbN5vV8=
-github.com/synopackageland/syno-pkg-land-sdk v0.38.2/go.mod h1:8GwREGbczc8mAk4Gv8FUHaukXXCUstjzkovQrNV59Cc=
+github.com/synopackageland/syno-pkg-land-sdk v0.41.1 h1:DnNgIOz08eG9xh1rJjGreHkGdba6ABFtxxG+7PgWMzs=
+github.com/synopackageland/syno-pkg-land-sdk v0.41.1/go.mod h1:8GwREGbczc8mAk4Gv8FUHaukXXCUstjzkovQrNV59Cc=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-go/backend/internal/app/background.go

@@ -10,7 +10,6 @@ import (
 	"os"
 	"os/user"
 	"path/filepath"
-	"strings"
 	"syscall"
 	"time"
 
@@ -125,7 +124,7 @@ func (b backgroundAPI) submit(ctx context.Context, _ api.Caller, _ *http.Request
 	if !access.Owner.Valid() {
 		return nil, &api.Error{Code: "identity_unavailable", Message: "DSM user UID could not be resolved"}
 	}
-	data, err := b.readInput(in.Input)
+	data, err := b.readInput(in.Input, access.Owner)
 	if err != nil {
 		return nil, err
 	}
@@ -138,20 +137,19 @@ func (b backgroundAPI) submit(ctx context.Context, _ api.Caller, _ *http.Request
 	return map[string]any{"job": job, "duplicate": duplicate}, nil
 }
 
-// readInput accepts only an existing regular file inside the App data directory,
-// outside the job spool.
-// The App's producer imports it first; jobs and schedules retain a private copy.
-func (b backgroundAPI) readInput(input string) ([]byte, error) {
-	bad := api.BadRequest("input must be a regular file in the App data directory")
-	rel, err := filepath.Rel(b.dataDir, input)
-	if err != nil || !filepath.IsAbs(input) || !filepath.IsLocal(rel) {
+// readInput opens only the authenticated owner's producer inbox. os.Root
+// confines symlinks as well as lexical paths to that inbox, including for admins.
+func (b backgroundAPI) readInput(input string, owner background.Submitter) ([]byte, error) {
+	bad := api.BadRequest("input must be a regular file in your App inbox")
+	inbox, err := BackgroundInbox(b.dataDir, owner)
+	if err != nil {
 		return nil, bad
 	}
-	// The job spool keeps other owners' private copies; it is never an input.
-	if first, _, _ := strings.Cut(filepath.ToSlash(rel), "/"); first == "background" {
+	rel, err := filepath.Rel(inbox, input)
+	if err != nil || !filepath.IsAbs(input) || !filepath.IsLocal(rel) {
 		return nil, bad
 	}
-	root, err := os.OpenRoot(b.dataDir)
+	root, err := os.OpenRoot(inbox)
 	if err != nil {
 		return nil, bad
 	}

package/templates/native-go/backend/internal/app/background_inbox_test.go

@@ -0,0 +1,37 @@
+package app
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/synopackageland/syno-pkg-land-sdk/background"
+)
+
+func TestBackgroundSubmitRefusesOtherOwnerInboxAndAppFiles(t *testing.T) {
+	e := ordinaryEnv(t)
+	private := filepath.Join(e.dataDir, "private-settings")
+	if err := os.WriteFile(private, []byte("private"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	for _, input := range []string{private, e.inputPath("alice")} {
+		p, _ := json.Marshal(map[string]string{"key": "stolen", "name": "copy", "input": input})
+		if code, _ := e.call(bob, "bg.jobs.submit", string(p)); code != "bad_request" {
+			t.Fatal("cross-owner import accepted", code)
+		}
+	}
+	own := e.inputPath("bob")
+	if err := os.Symlink(private, filepath.Join(filepath.Dir(own), "escape")); err != nil {
+		t.Fatal(err)
+	}
+	p, _ := json.Marshal(map[string]string{"key": "link", "name": "copy", "input": filepath.Join(filepath.Dir(own), "escape")})
+	if code, _ := e.call(bob, "bg.jobs.submit", string(p)); code != "bad_request" {
+		t.Fatal("inbox symlink escaped", code)
+	}
+	old, _ := BackgroundInbox(e.dataDir, background.Submitter{User: "bob", UID: "1025"})
+	current, _ := BackgroundInbox(e.dataDir, background.Submitter{User: "bob", UID: "2048"})
+	if old == current {
+		t.Fatal("recreated user retained its inbox")
+	}
+}

package/templates/native-go/backend/internal/app/background_owner.go

@@ -2,10 +2,13 @@ package app
 
 import (
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
 	"github.com/synopackageland/syno-pkg-land-sdk/api"
 	"github.com/synopackageland/syno-pkg-land-sdk/background"
 	"net/http"
+	"path/filepath"
 )
 
 type backgroundAccessKey struct{}
@@ -36,3 +39,14 @@ func (b backgroundAPI) purge(ctx context.Context, c api.Caller, _ *http.Request,
 	}
 	return audit, nil
 }
+
+// BackgroundInbox is the private input directory a trusted App producer fills
+// for an authenticated owner. Both account name and UID are part of its key.
+func BackgroundInbox(dataDir string, owner background.Submitter) (string, error) {
+	if !owner.Valid() {
+		return "", api.BadRequest("exact owner is required")
+	}
+	raw, _ := json.Marshal([2]string{owner.User, owner.UID})
+	key := sha256.Sum256(raw)
+	return filepath.Join(dataDir, "inbox", hex.EncodeToString(key[:])), nil
+}

package/templates/native-go/backend/internal/app/background_owner_test.go

@@ -28,7 +28,7 @@ var carol = stubAuth{identity: api.Identity{User: "carol"}}
 
 func ownerSubmit(t *testing.T, e *bgEnv, a api.Authenticator, key string) string {
 	t.Helper()
-	code, out := e.call(a, "bg.jobs.submit", e.submitParams(key))
+	code, out := e.call(a, "bg.jobs.submit", e.submitParams(key, a.(stubAuth).identity.User))
 	if code != "" {
 		t.Fatalf("submit %s: %s %v", key, code, out)
 	}
@@ -103,7 +103,7 @@ func TestBackgroundPersonalQuotaAndAdminPurge(t *testing.T) {
 	}
 	ownerSubmit(t, e, bob, "one")
 	ownerSubmit(t, e, bob, "two")
-	if code, _ := e.call(bob, "bg.jobs.submit", e.submitParams("three")); code != "owner-queue-full" {
+	if code, _ := e.call(bob, "bg.jobs.submit", e.submitParams("three", "bob")); code != "owner-queue-full" {
 		t.Fatal(code)
 	}
 	ownerSubmit(t, e, carol, "one")

package/templates/native-go/backend/internal/app/background_test.go

@@ -28,10 +28,9 @@ func newBgEnv(t *testing.T) *bgEnv {
 	t.Cleanup(func() { lookupSubmitterUID = osLookupUID })
 	dir := t.TempDir()
 	store := background.NewStore(filepath.Join(dir, "background"))
-	if err := os.WriteFile(filepath.Join(dir, "input.txt"), []byte("hello"), 0600); err != nil {
-		t.Fatal(err)
-	}
-	return &bgEnv{t: t, store: store, dataDir: dir, srv: map[string]*api.Server{}}
+	e := &bgEnv{t: t, store: store, dataDir: dir, srv: map[string]*api.Server{}}
+	e.inputPath("alice")
+	return e
 }
 
 func (e *bgEnv) call(auth api.Authenticator, method, params string) (string, map[string]any) {
@@ -128,8 +127,28 @@ func TestBackgroundStatusReportsLimitsAndWorker(t *testing.T) {
 	}
 }
 
-func (e *bgEnv) submitParams(key string) string {
-	p, err := json.Marshal(map[string]string{"key": key, "name": "a.txt", "input": filepath.Join(e.dataDir, "input.txt")})
+func (e *bgEnv) inputPath(user string) string {
+	inbox, err := BackgroundInbox(e.dataDir, background.Submitter{User: user, UID: lookupSubmitterUID(user)})
+	if err != nil {
+		e.t.Fatal(err)
+	}
+	if err = os.MkdirAll(inbox, 0700); err != nil {
+		e.t.Fatal(err)
+	}
+	input := filepath.Join(inbox, "input.txt")
+	if _, err = os.Stat(input); os.IsNotExist(err) {
+		if err = os.WriteFile(input, []byte("hello"), 0600); err != nil {
+			e.t.Fatal(err)
+		}
+	}
+	return input
+}
+func (e *bgEnv) submitParams(key string, users ...string) string {
+	user := "alice"
+	if len(users) > 0 {
+		user = users[0]
+	}
+	p, err := json.Marshal(map[string]string{"key": key, "name": "a.txt", "input": e.inputPath(user)})
 	if err != nil {
 		e.t.Fatal(err)
 	}
@@ -155,7 +174,7 @@ func TestBackgroundSubmitImportsAppInputAndIsIdempotent(t *testing.T) {
 	if data(again)["duplicate"] != true || data(again)["job"].(map[string]any)["id"] != job["id"] {
 		t.Fatal(again)
 	}
-	if err := os.WriteFile(filepath.Join(e.dataDir, "input.txt"), []byte("other"), 0600); err != nil {
+	if err := os.WriteFile(e.inputPath("alice"), []byte("other"), 0600); err != nil {
 		t.Fatal(err)
 	}
 	if code, _ := e.call(alice, "bg.jobs.submit", params); code != "conflict" {
@@ -189,7 +208,7 @@ func TestBackgroundSubmitRejectsExternalAndOversizedInput(t *testing.T) {
 			t.Fatalf("%s: %s", input, code)
 		}
 	}
-	if err := os.WriteFile(filepath.Join(e.dataDir, "input.txt"), make([]byte, background.MaxInputBytes+1), 0600); err != nil {
+	if err := os.WriteFile(e.inputPath("alice"), make([]byte, background.MaxInputBytes+1), 0600); err != nil {
 		t.Fatal(err)
 	}
 	if code, _ := e.call(alice, "bg.jobs.submit", e.submitParams("big")); code != "limit-exceeded" {

package/templates/native-go-delegate/frontend/src/CapabilityPanels.vue

@@ -30,7 +30,7 @@ onBeforeUnmount(()=>{disposed=true;provider.dispose()})
  <BackgroundSavePanel v-if="mode==='long'" ref="panel" :key="revision" :sdk="sdk" :admin="admin" :locale="ctx.locale" :picker="{provider,keys}" sample-save />
  <DelegatePanel v-else-if="mode==='legacy'" ref="panel" :ctx="ctx" />
  <SectionSkeleton v-else-if="mode==='loading'" />
- <Callout v-else tone="danger" role="alert">
+ <Callout v-else tone="danger" role="alert" :dismissible="false">
   {{ copy.error }}
   <template #actions><Button variant="secondary" @click="detect">{{ copy.retry }}</Button></template>
  </Callout>

package/templates/native-go-delegate/frontend/test/capability-panels.test.ts

@@ -136,6 +136,7 @@ test('a failed status check offers Retry as a Callout action and recovers',async
  const retry=button(root,'Retry')
  expect(alert.querySelector('[data-ui-callout-actions]')?.contains(retry)).toBe(true)
  expect(alert.querySelector('[data-ui-callout-body]')?.querySelector('button')).toBeNull()
+ expect(alert.querySelector('[data-ui-callout-close]')).toBeNull()
  retry.click();await settle()
  expect(attempts).toBe(2)
  expect(root.querySelector('[role="alert"]')).toBeNull()