@synopackageland/cli 0.10.0 → 0.10.2

package/CHANGELOG.md

@@ -1,5 +1,61 @@
 # Changelog
 
+## 0.10.2 (2026-10-14)
+
+Builds with SDK 0.10.2 and templates 0.10.2: `init` writes SDK v0.10.2 (Go
+module, Rust crate tag and `backend.sdk`) and `@synopackageland/sdk` 0.10.2.
+The executor digest table adds SDK 0.10.2 and keeps 0.10.0 and 0.10.1. SDK
+0.10.2's executor changed (it adds `check-policy`), so an App rebuilt on it
+carries a new executor digest; when its policy digest does not change, the
+upgrade puts the new executor in place without approval. The lifecycle
+digests equal 0.10.1.
+
+繁中摘要：使用 SDK 0.10.2 與 templates 0.10.2；digest 表新增 SDK 0.10.2（保留
+0.10.0、0.10.1）。executor 變更（新增 check-policy），policy digest 不變的 App
+升級時自動換 executor，不需重新核准；lifecycle digest 與 0.10.1 相同。
+
+- `check` and `build` have the App's SDK executor validate the executor policy
+  (`executor check-policy`, SDK 0.10.2 and later, which `init` now writes; built for this host from the
+  App's SDK version, or from `SYNOPKGLAND_SDK_DIR`). A policy the executor
+  would refuse fails with `EXECUTOR_POLICY_REJECTED`, the executor's reason and
+  the dsm-package.yaml part to fix, instead of failing only at approval on the
+  NAS. Apps without delegate or rootOps, and SDKs before check-policy, are not
+  checked.
+- Fix: `inspect` reports an SDK it cannot download as `SDK_DOWNLOAD_FAILED`
+  with the GOPRIVATE hint. It was `SPK_INSPECTION_FAILED` ("Executor inventory
+  invalid", "do not install an SPK that fails inspection"), which blamed a
+  valid SPK for the machine's Go setup.
+- Fix: a DSM window (and a Portal or standalone launch) passes the App
+  `ctx.displayName` in the DSM language: the translated `i18n.info.<locale>.displayname`,
+  the name DSM shows in the window title, else the English `displayname`. It
+  was always the English name, so a narrow-window header and the title bar
+  disagreed under a translated DSM.
+
+## 0.10.1 (2026-10-13)
+
+Builds with SDK 0.10.1 and templates 0.10.1: `init` writes SDK v0.10.1 (Go
+module, Rust crate tag and `backend.sdk`) and `@synopackageland/sdk` 0.10.1.
+The executor digest table adds SDK 0.10.1 and keeps 0.10.0. SDK 0.10.1's
+executor changed, so an App rebuilt on it carries a new executor digest and
+its pins are approved again; the lifecycle digests equal 0.10.0. The bridge
+manifest schema is synced from the SDK (`capabilities.root` also serves
+`executor.status` and `executor.control`).
+
+繁中摘要：使用 SDK 0.10.1 與 templates 0.10.1；digest 表新增 SDK 0.10.1（保留
+0.10.0）。executor 變更，改用 SDK 0.10.1 重建的 App 要重新核准 executor digest，
+lifecycle digest 與 0.10.0 相同。
+
+- A Python, Node.js or Rust App with root-ops and a Vue UI borrows
+  `native-go-root-ops/frontend`, as a Go App gets it from its overlay: its
+  `ExecutorGate.vue` holds the App's pages until an administrator approves
+  the executor (templates 0.10.1).
+- Fix: in a DSM window with root operations (`capabilities.rootOps`, and so a
+  `portal` App), the App root now fills the window body below the root panels.
+  It had no height, so an App root asking for `height:100%` collapsed to its
+  content: a loading overlay covered only the top of the window, and a dialog
+  centred on the App root was placed above the window. Windows without root
+  operations are unchanged.
+
 ## 0.10.0 (2026-10-13)
 
 Builds with SDK 0.10.0 and templates 0.10.0: `init` writes SDK v0.10.0 (Go

package/dist/capability-overlays.js

@@ -22,7 +22,7 @@ function bridgeOverlays(template) {
     return {
         // The example hashes a file the caller picks, which the runtime reads only for an App with files.
         jobs: { overlays: [`${template}-jobs`], borrowed: ['native-go-jobs/frontend'], removed: [], permissions: {}, implied: ['files'], methods: ['hash.submit', 'hash.get', 'hash.cancel'] },
-        'root-ops': { overlays: [`${template}-root-ops`], borrowed: ['native-go-root-ops/root'], removed: [], permissions: {}, methods: ['whoami.run'] },
+        'root-ops': { overlays: [`${template}-root-ops`], borrowed: ['native-go-root-ops/root', 'native-go-root-ops/frontend'], removed: [], permissions: {}, methods: ['whoami.run'] },
         delegate: {
             overlays: [`${template}-delegate`], borrowed: ['native-go-jobs/frontend', 'native-go-delegate/frontend'], removed: [],
             permissions: { 'app.status': 'authenticated', 'report.save': 'authenticated' }, methods: ['report.save'],

package/dist/error-registry.js

@@ -757,6 +757,7 @@ for (const [code, description, suggestion] of [
     ["TEMPLATES_MISSING", "@synopackageland/templates was not found.", "Reinstall @synopackageland/cli, or point SYNOPKGLAND_TEMPLATES_DIR at a templates checkout."],
     ["EXECUTOR_PIN_REQUIRED", "A package that declares rootOps or delegate was built without the executor artifact.", "Use synopkgland build so the CLI compiles and pins the executor; do not call the low-level SPK API directly."],
     ["EXECUTOR_POLICY", "capabilities.delegate has invalid operations or scope, or a binary root program lacks the file for this architecture, so the executor policy cannot be generated.", "Use the delegate declaration init/add produces and fix scope and operations against the manifest reference; for binary root programs provide root/<arch>/<name> for every arch in arches."],
+    ["EXECUTOR_POLICY_REJECTED", "The executor of the App's SDK version refuses the policy the CLI generated, so the NAS would refuse it at approval.", "The reason names the refused part: policy root/stop/purge → root.programs (schema, run, job), root.stop, uninstall.purge; policy scope/operation/destination/move/lifetime → capabilities.delegate; policy portal → portal; policy entry → entry. Fix that part of dsm-package.yaml; if it already matches the manifest reference, use the SDK version this CLI release names."],
     ["EXECUTOR_ROOT_PROGRAMS_UNSUPPORTED", "The root settings in dsm-package.yaml need an executor that supports root program settings, which the App's SDK version lacks.", "Use an SDK with root programs, stop and root_state (executor/stop_step.go), or remove the root settings."],
     ["EXECUTOR_PACKAGE", "The package name pinned into the root task is invalid.", "package must start with a letter and contain only alphanumerics (2-64 characters)."],
     ["EXECUTOR_DIGEST", "The sha256 pin for the executor or policy is malformed.", "Build again so the CLI recomputes the pin; do not hand-edit pins inside the SPK."],

package/dist/runtime/executor-build.js

@@ -9,6 +9,7 @@ import { executorTasks } from './executor-tasks.js';
 import { copyModule, verifyExecutorDigests } from './executor-source.js';
 import { requiredSdk } from './sdk-source.js';
 import { rootProgramsUnsupported } from './root-programs.js';
+import { executorPolicyProblem } from './executor-policy-check.js';
 /** CLI-owned build flags; the release digest table is computed the same way, so they must not change within an SDK minor. */
 const GO_BUILD = ['build', '-trimpath', '-buildvcs=false', '-ldflags', '-s -w -buildid=', '-o'];
 function failure(error) {
@@ -75,6 +76,15 @@ export async function buildExecutor(m, arch, work, run, options = {}) {
     if (unsupported)
         throw new StandaloneBuildError('EXECUTOR_ROOT_PROGRAMS_UNSUPPORTED', unsupported);
     const policyText = executorPolicyText(policy);
+    let refused;
+    try {
+        refused = executorPolicyProblem(source, sdk.version, m.package, policyText, options.env);
+    }
+    catch (error) {
+        throw failure(error);
+    }
+    if (refused)
+        throw new StandaloneBuildError('EXECUTOR_POLICY_REJECTED', refused);
     const pins = { package: m.package, executorDigest, policyDigest: sha256(policyText) };
     return { ...pins, binary, lifecycleBinary, policy, policyText, tasks: executorTasks(pins, sdk.executorDir), implementation: 'executor', sdk: sdk.version, warnings };
 }

package/dist/runtime/executor-digests.json

@@ -9,5 +9,27 @@
             "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
         },
         "goToolchain": "go1.26.9"
+    },
+    "0.10.1": {
+        "x86_64": "51b538e6ec1cb8fa2a4e00291eda097969352d6e2d9a3e7ade5da5359f1065de",
+        "aarch64": "9038b5ad7b4822e967f18390ca28b6f0021a3044ed461809b3f7333f17400840",
+        "armv7": "22d872cc618e3af4a052955186d36a6851e9f96ad959ee8ea7d3fbb5eec968bd",
+        "lifecycle": {
+            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
+            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
+            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
+        },
+        "goToolchain": "go1.26.9"
+    },
+    "0.10.2": {
+        "x86_64": "bb7aebb120562633e852d590007870489b7839ea2c943db897b7a71dea743fae",
+        "aarch64": "2fd8365aabfa2ea2ea7c767f89fa8222d7f4fc04cbdde6b7d510c74002a5bb89",
+        "armv7": "6f757614eab802fa07c2601c801bcf2c14ad3076d7c01f9ed20d62744ef13979",
+        "lifecycle": {
+            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
+            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
+            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
+        },
+        "goToolchain": "go1.26.9"
     }
 }

package/dist/runtime/executor-inspect.js

@@ -43,6 +43,9 @@ export function inspectExecutor(dir, pkg, arch) {
         return { executor: { executorDigest, policyDigest, policy, implementation: plan.implementation, sdk: plan.sdk, tasks: tasks.map(task => ({ ...task, state: 'unknown' })) }, findings: [] };
     }
     catch (e) {
+        // A failed SDK download is this machine's Go setup (GOPRIVATE), not a defect of the SPK.
+        if (e.message.startsWith('[SDK_DOWNLOAD_FAILED]'))
+            throw e;
         return { findings: ['Executor inventory invalid: ' + e.message] };
     }
 }

package/dist/runtime/executor-policy-check.d.ts

@@ -0,0 +1,14 @@
+import { type StandaloneManifest } from '../standalone/manifest.js';
+/**
+ * Why the SDK executor would refuse the policy, such as `invalid policy: policy root`;
+ * undefined when it accepts it or its SDK predates check-policy. The executor is
+ * built for this host from executorDir, so its own rules decide, not a copy in the CLI.
+ */
+export declare function executorPolicyRefusal(executorDir: string, pkg: string, policyText: string, env?: NodeJS.ProcessEnv): string | undefined;
+/** The EXECUTOR_POLICY_REJECTED message for a policy the SDK executor refuses; undefined when it accepts it. */
+export declare function executorPolicyProblem(executorDir: string, sdkVersion: string, pkg: string, policyText: string, env?: NodeJS.ProcessEnv): string | undefined;
+/** The policy of each architecture `check` would build, checked by the App's SDK executor; Apps without executor need none. */
+export declare function manifestPolicyProblem(m: StandaloneManifest, env?: NodeJS.ProcessEnv): {
+    code: string;
+    message: string;
+} | undefined;

package/dist/runtime/executor-policy-check.js

@@ -0,0 +1,72 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { PINNED_GO_HINT, PINNED_GO_TOOLCHAIN } from '../build-spk/go-toolchain.js';
+import { sdkBackend } from '../standalone/manifest.js';
+import { executorPolicy, executorPolicyText } from './executor-policy.js';
+import { requiredSdk } from './sdk-source.js';
+/** The executor subcommand that validates a policy on stdin as load() does (SDK 0.10.2 and later). */
+const CHECK_POLICY = 'check-policy';
+/**
+ * Why the SDK executor would refuse the policy, such as `invalid policy: policy root`;
+ * undefined when it accepts it or its SDK predates check-policy. The executor is
+ * built for this host from executorDir, so its own rules decide, not a copy in the CLI.
+ */
+export function executorPolicyRefusal(executorDir, pkg, policyText, env = process.env) {
+    const main = join(executorDir, 'main.go');
+    if (!existsSync(main) || !readFileSync(main, 'utf8').includes(`"${CHECK_POLICY}"`))
+        return undefined;
+    const dir = mkdtempSync(join(tmpdir(), 'synopkgland-check-policy-'));
+    try {
+        const binary = join(dir, 'executor');
+        const { GOOS: _os, GOARCH: _arch, ...host } = env;
+        const build = spawnSync('go', ['build', '-o', binary, '.'], { cwd: executorDir, env: { ...host, GOTOOLCHAIN: PINNED_GO_TOOLCHAIN, GOFLAGS: '', GOWORK: 'off', CGO_ENABLED: '0' }, encoding: 'utf8' });
+        if (build.error || build.status !== 0)
+            throw new Error(`[EXECUTOR_BUILD_FAILED] Building the SDK executor for this host to check the policy failed. ${PINNED_GO_HINT}\n${build.stderr || build.error?.message}`);
+        const result = spawnSync(binary, [CHECK_POLICY, '--package', pkg], { input: policyText, encoding: 'utf8' });
+        if (result.status === 0)
+            return undefined;
+        const reason = /^executor: (.*)$/m.exec(result.stderr ?? '')?.[1];
+        if (result.status === 1 && reason)
+            return reason;
+        throw new Error(`[EXECUTOR_BUILD_FAILED] executor ${CHECK_POLICY} did not run: ${result.stderr || result.error?.message}`);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+/** Where in dsm-package.yaml each executor refusal comes from. */
+const POLICY_FIX = [
+    [/policy (root|stop|purge)/, 'fix root.programs (schema, run, job), root.stop or uninstall.purge in dsm-package.yaml'],
+    [/policy (scope|operation|destination|move|lifetime)/, 'fix capabilities.delegate in dsm-package.yaml'],
+    [/policy portal/, 'fix portal in dsm-package.yaml'],
+    [/policy entry/, 'fix entry in dsm-package.yaml'],
+];
+/** The EXECUTOR_POLICY_REJECTED message for a policy the SDK executor refuses; undefined when it accepts it. */
+export function executorPolicyProblem(executorDir, sdkVersion, pkg, policyText, env = process.env) {
+    const reason = executorPolicyRefusal(executorDir, pkg, policyText, env);
+    if (!reason)
+        return undefined;
+    const fix = POLICY_FIX.find(([pattern]) => pattern.test(reason))?.[1] ?? 'fix the declaration in dsm-package.yaml';
+    return `The executor of SDK ${sdkVersion} refuses this App's policy (executor: ${reason}), so the NAS would refuse it at approval: ${fix}.`
+        + ' If dsm-package.yaml already matches the manifest reference, this CLI and the SDK disagree: use the SDK version this CLI release names.';
+}
+/** The policy of each architecture `check` would build, checked by the App's SDK executor; Apps without executor need none. */
+export function manifestPolicyProblem(m, env = process.env) {
+    if (!m.capabilities.delegate && !m.capabilities.rootOps)
+        return undefined;
+    try {
+        const sdk = requiredSdk(sdkBackend(m), env);
+        for (const text of new Set(m.arches.map(arch => executorPolicyText(executorPolicy(m, arch))))) {
+            const message = executorPolicyProblem(sdk.executorDir, sdk.version, m.package, text, env);
+            if (message)
+                return { code: 'EXECUTOR_POLICY_REJECTED', message };
+        }
+    }
+    catch (error) {
+        const coded = /^\[([A-Z0-9_]+)\] ([\s\S]*)$/.exec(error.message);
+        return { code: coded?.[1] ?? 'EXECUTOR_BUILD_FAILED', message: coded?.[2] ?? error.message };
+    }
+    return undefined;
+}

package/dist/standalone/dsm-window.js

@@ -72,6 +72,15 @@ export function entryLauncherAccess(entry) {
 export function appTitle(manifest) {
     return { displayname: manifest.displayname, description: manifest.description, info: manifest.i18n?.info };
 }
+/** The app name by locale, as `ui/texts` names the window: `createI18n(lang, ...).t("app_title")`. */
+function displayNameCatalogs(manifest) {
+    const catalogs = { en: { app_title: manifest.displayname } };
+    for (const [locale, text] of Object.entries(manifest.i18n?.info ?? {})) {
+        if (text?.displayname)
+            catalogs[locale] = { app_title: text.displayname };
+    }
+    return catalogs;
+}
 /** `ui/config`: registers the DSM main-menu app and its window class. */
 export function renderUiConfig(manifest, icons = packageIcons(manifest.icon)) {
     const icon = windowIconTemplate(icons);
@@ -268,7 +277,7 @@ ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
         root.lang = i18n.locale;
         try {
           me.mounted = app.mount(root, Ext.apply(ctx, {
-          displayName: ${JSON.stringify(manifest.displayname)},
+          displayName: ${ns}.createI18n(lang, ${JSON.stringify(displayNameCatalogs(manifest))}).t("app_title"),
           call: call,
           files: {endpoint: ${JSON.stringify(cgiUrl(pkg))}, token: function () { return SYNO.SDS.Session && SYNO.SDS.Session.SynoToken; }},
           reopen: me.reopenEvents.subscribe,
@@ -363,6 +372,9 @@ const ROOT_PANEL_CSS = [
     ".dsmapp-rootpanel-actions button{margin-right:8px;padding:4px 14px}",
     ".dsmapp-rootpanel-primary{background:#057feb;color:#fff;border:1px solid #057feb;border-radius:3px}",
     ".dsmapp-rootpanel-hint{color:#526070;font-size:12px}.dsmapp-rootpanel [hidden]{display:none}",
+    // The panels keep their height; the App root fills the rest of the window body, as without root operations.
+    ".dsmapp-rootwindow{display:flex;flex-direction:column;height:100%}",
+    ".dsmapp-rootwindow>.dsmapp-rootpanels{flex:none}.dsmapp-rootwindow>.dsmapp-root{flex:1 1 0;min-height:0}",
 ].join("");
 /**
  * A Vue app approves in the SDK's ExecutorSettings, which also carries an
@@ -374,7 +386,7 @@ function settingsOnlyApproval(manifest) {
 /**
  * The capabilities.rootOps: true additions to the window: the exact tasks and panel
  * text, the access runtime wired to DSM's own password confirmation and the
- * AppWindow's WebAPI channel, and the panel above the app.
+ * AppWindow's WebAPI channel, and the panel above the app, which fills the rest.
  */
 function renderRootParts(ns, manifest) {
     return {
@@ -394,7 +406,7 @@ ${PASSWORD_CONFIRM}
 
 `,
         html: `autoScroll: true,
-      html: '<style>${ROOT_PANEL_CSS}</style><div class="dsmapp-rootpanels"></div><div class="dsmapp-root"></div>'`,
+      html: '<style>${ROOT_PANEL_CSS}</style><div class="dsmapp-rootwindow"><div class="dsmapp-rootpanels"></div><div class="dsmapp-root"></div></div>'`,
         mount: `    var session = function () {
       var current = SYNO.SDS.Session || {};
       return { name: current.user, admin: current.is_admin === true };

package/dist/validate.js

@@ -9,6 +9,7 @@ import { classifyComposeRoute, collectComposeInterpolations, collectVolumeSource
 import { usesAuthGateway } from "./contract/web-launch.js";
 import { isNativeLayout, loadNativeLayout } from "./standalone/native-layout.js";
 import { loadStandaloneManifest } from "./standalone/manifest.js";
+import { manifestPolicyProblem } from "./runtime/executor-policy-check.js";
 import { COMPOSE_FILENAME, CONTRACT_FILENAME, DSM_PACKAGE_FILENAME, } from "./discovery.js";
 import { declaredPrivilegeFlags } from "./compose/privilege.js";
 export function validateProject(project, options = {}) {
@@ -29,7 +30,9 @@ export function validateProject(project, options = {}) {
     }
     if (hasStandalone) {
         const loaded = isNativeLayout(project.root) ? loadNativeLayout(project.root) : loadStandaloneManifest(project.root);
-        return loaded.ok ? { ok: true, errors: [] } : { ok: false, errors: loaded.errors.map(error => ({
+        const policy = loaded.ok && "capabilities" in loaded.manifest ? manifestPolicyProblem(loaded.manifest) : undefined;
+        const problems = loaded.ok ? (policy ? [policy] : []) : loaded.errors;
+        return !problems.length ? { ok: true, errors: [] } : { ok: false, errors: problems.map(error => ({
                 ...error, span: { file: DSM_PACKAGE_FILENAME, line: 1, column: 1 },
                 suggestion: getErrorCode(error.code)?.suggestion ?? "Fix the schema 2 fields and capability declarations in dsm-package.yaml.",
             })) };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -24,7 +24,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@synopackageland/templates": "0.10.0",
+    "@synopackageland/templates": "0.10.2",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "tar": "^7.4.3",

package/schema/bridge-manifest.v1.schema.json

@@ -59,7 +59,7 @@
         "identity": { "const": "standalone", "$comment": "The SDK's App sign-in (identity.*) authenticates instead of DSM." },
         "portal": { "type": "boolean", "$comment": "true serves portal.status, to the browser and as the svc portal.status." },
         "jobs": { "type": "boolean", "$comment": "Added in v1 (additive). true offers the svc bg.submit, bg.get and bg.cancel on the package's job store." },
-        "root": { "type": "boolean", "$comment": "Added in v1 (additive). true offers the svc root.run, root.start, root.jobs.list, root.jobs.get and root.jobs.stop: the runtime forwards them to the package's executor with the request's DSM session, and the executor's policy and the App privilege decide." },
+        "root": { "type": "boolean", "$comment": "Added in v1 (additive). true offers the svc root.run, root.start, root.jobs.list, root.jobs.get and root.jobs.stop: the runtime forwards them to the package's executor with the request's DSM session, and the executor's policy and the App privilege decide. It also serves the browser routes executor.status and executor.control (README, Executor routes)." },
         "delegate": {
           "type": "object",
           "additionalProperties": false,