@synopackageland/cli 0.10.1 → 0.10.2

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 0.10.2 (2026-10-14)
+
+Builds with SDK 0.10.2 and templates 0.10.2: `init` writes SDK v0.10.2 (Go
+module, Rust crate tag and `backend.sdk`) and `@synopackageland/sdk` 0.10.2.
+The executor digest table adds SDK 0.10.2 and keeps 0.10.0 and 0.10.1. SDK
+0.10.2's executor changed (it adds `check-policy`), so an App rebuilt on it
+carries a new executor digest; when its policy digest does not change, the
+upgrade puts the new executor in place without approval. The lifecycle
+digests equal 0.10.1.
+
+繁中摘要：使用 SDK 0.10.2 與 templates 0.10.2；digest 表新增 SDK 0.10.2（保留
+0.10.0、0.10.1）。executor 變更（新增 check-policy），policy digest 不變的 App
+升級時自動換 executor，不需重新核准；lifecycle digest 與 0.10.1 相同。
+
+- `check` and `build` have the App's SDK executor validate the executor policy
+  (`executor check-policy`, SDK 0.10.2 and later, which `init` now writes; built for this host from the
+  App's SDK version, or from `SYNOPKGLAND_SDK_DIR`). A policy the executor
+  would refuse fails with `EXECUTOR_POLICY_REJECTED`, the executor's reason and
+  the dsm-package.yaml part to fix, instead of failing only at approval on the
+  NAS. Apps without delegate or rootOps, and SDKs before check-policy, are not
+  checked.
+- Fix: `inspect` reports an SDK it cannot download as `SDK_DOWNLOAD_FAILED`
+  with the GOPRIVATE hint. It was `SPK_INSPECTION_FAILED` ("Executor inventory
+  invalid", "do not install an SPK that fails inspection"), which blamed a
+  valid SPK for the machine's Go setup.
+- Fix: a DSM window (and a Portal or standalone launch) passes the App
+  `ctx.displayName` in the DSM language: the translated `i18n.info.<locale>.displayname`,
+  the name DSM shows in the window title, else the English `displayname`. It
+  was always the English name, so a narrow-window header and the title bar
+  disagreed under a translated DSM.
+
 ## 0.10.1 (2026-10-13)
 
 Builds with SDK 0.10.1 and templates 0.10.1: `init` writes SDK v0.10.1 (Go

package/dist/error-registry.js

@@ -757,6 +757,7 @@ for (const [code, description, suggestion] of [
     ["TEMPLATES_MISSING", "@synopackageland/templates was not found.", "Reinstall @synopackageland/cli, or point SYNOPKGLAND_TEMPLATES_DIR at a templates checkout."],
     ["EXECUTOR_PIN_REQUIRED", "A package that declares rootOps or delegate was built without the executor artifact.", "Use synopkgland build so the CLI compiles and pins the executor; do not call the low-level SPK API directly."],
     ["EXECUTOR_POLICY", "capabilities.delegate has invalid operations or scope, or a binary root program lacks the file for this architecture, so the executor policy cannot be generated.", "Use the delegate declaration init/add produces and fix scope and operations against the manifest reference; for binary root programs provide root/<arch>/<name> for every arch in arches."],
+    ["EXECUTOR_POLICY_REJECTED", "The executor of the App's SDK version refuses the policy the CLI generated, so the NAS would refuse it at approval.", "The reason names the refused part: policy root/stop/purge → root.programs (schema, run, job), root.stop, uninstall.purge; policy scope/operation/destination/move/lifetime → capabilities.delegate; policy portal → portal; policy entry → entry. Fix that part of dsm-package.yaml; if it already matches the manifest reference, use the SDK version this CLI release names."],
     ["EXECUTOR_ROOT_PROGRAMS_UNSUPPORTED", "The root settings in dsm-package.yaml need an executor that supports root program settings, which the App's SDK version lacks.", "Use an SDK with root programs, stop and root_state (executor/stop_step.go), or remove the root settings."],
     ["EXECUTOR_PACKAGE", "The package name pinned into the root task is invalid.", "package must start with a letter and contain only alphanumerics (2-64 characters)."],
     ["EXECUTOR_DIGEST", "The sha256 pin for the executor or policy is malformed.", "Build again so the CLI recomputes the pin; do not hand-edit pins inside the SPK."],

package/dist/runtime/executor-build.js

@@ -9,6 +9,7 @@ import { executorTasks } from './executor-tasks.js';
 import { copyModule, verifyExecutorDigests } from './executor-source.js';
 import { requiredSdk } from './sdk-source.js';
 import { rootProgramsUnsupported } from './root-programs.js';
+import { executorPolicyProblem } from './executor-policy-check.js';
 /** CLI-owned build flags; the release digest table is computed the same way, so they must not change within an SDK minor. */
 const GO_BUILD = ['build', '-trimpath', '-buildvcs=false', '-ldflags', '-s -w -buildid=', '-o'];
 function failure(error) {
@@ -75,6 +76,15 @@ export async function buildExecutor(m, arch, work, run, options = {}) {
     if (unsupported)
         throw new StandaloneBuildError('EXECUTOR_ROOT_PROGRAMS_UNSUPPORTED', unsupported);
     const policyText = executorPolicyText(policy);
+    let refused;
+    try {
+        refused = executorPolicyProblem(source, sdk.version, m.package, policyText, options.env);
+    }
+    catch (error) {
+        throw failure(error);
+    }
+    if (refused)
+        throw new StandaloneBuildError('EXECUTOR_POLICY_REJECTED', refused);
     const pins = { package: m.package, executorDigest, policyDigest: sha256(policyText) };
     return { ...pins, binary, lifecycleBinary, policy, policyText, tasks: executorTasks(pins, sdk.executorDir), implementation: 'executor', sdk: sdk.version, warnings };
 }

package/dist/runtime/executor-digests.json

@@ -20,5 +20,16 @@
             "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
         },
         "goToolchain": "go1.26.9"
+    },
+    "0.10.2": {
+        "x86_64": "bb7aebb120562633e852d590007870489b7839ea2c943db897b7a71dea743fae",
+        "aarch64": "2fd8365aabfa2ea2ea7c767f89fa8222d7f4fc04cbdde6b7d510c74002a5bb89",
+        "armv7": "6f757614eab802fa07c2601c801bcf2c14ad3076d7c01f9ed20d62744ef13979",
+        "lifecycle": {
+            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
+            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
+            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
+        },
+        "goToolchain": "go1.26.9"
     }
 }

package/dist/runtime/executor-inspect.js

@@ -43,6 +43,9 @@ export function inspectExecutor(dir, pkg, arch) {
         return { executor: { executorDigest, policyDigest, policy, implementation: plan.implementation, sdk: plan.sdk, tasks: tasks.map(task => ({ ...task, state: 'unknown' })) }, findings: [] };
     }
     catch (e) {
+        // A failed SDK download is this machine's Go setup (GOPRIVATE), not a defect of the SPK.
+        if (e.message.startsWith('[SDK_DOWNLOAD_FAILED]'))
+            throw e;
         return { findings: ['Executor inventory invalid: ' + e.message] };
     }
 }

package/dist/runtime/executor-policy-check.d.ts

@@ -0,0 +1,14 @@
+import { type StandaloneManifest } from '../standalone/manifest.js';
+/**
+ * Why the SDK executor would refuse the policy, such as `invalid policy: policy root`;
+ * undefined when it accepts it or its SDK predates check-policy. The executor is
+ * built for this host from executorDir, so its own rules decide, not a copy in the CLI.
+ */
+export declare function executorPolicyRefusal(executorDir: string, pkg: string, policyText: string, env?: NodeJS.ProcessEnv): string | undefined;
+/** The EXECUTOR_POLICY_REJECTED message for a policy the SDK executor refuses; undefined when it accepts it. */
+export declare function executorPolicyProblem(executorDir: string, sdkVersion: string, pkg: string, policyText: string, env?: NodeJS.ProcessEnv): string | undefined;
+/** The policy of each architecture `check` would build, checked by the App's SDK executor; Apps without executor need none. */
+export declare function manifestPolicyProblem(m: StandaloneManifest, env?: NodeJS.ProcessEnv): {
+    code: string;
+    message: string;
+} | undefined;

package/dist/runtime/executor-policy-check.js

@@ -0,0 +1,72 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { PINNED_GO_HINT, PINNED_GO_TOOLCHAIN } from '../build-spk/go-toolchain.js';
+import { sdkBackend } from '../standalone/manifest.js';
+import { executorPolicy, executorPolicyText } from './executor-policy.js';
+import { requiredSdk } from './sdk-source.js';
+/** The executor subcommand that validates a policy on stdin as load() does (SDK 0.10.2 and later). */
+const CHECK_POLICY = 'check-policy';
+/**
+ * Why the SDK executor would refuse the policy, such as `invalid policy: policy root`;
+ * undefined when it accepts it or its SDK predates check-policy. The executor is
+ * built for this host from executorDir, so its own rules decide, not a copy in the CLI.
+ */
+export function executorPolicyRefusal(executorDir, pkg, policyText, env = process.env) {
+    const main = join(executorDir, 'main.go');
+    if (!existsSync(main) || !readFileSync(main, 'utf8').includes(`"${CHECK_POLICY}"`))
+        return undefined;
+    const dir = mkdtempSync(join(tmpdir(), 'synopkgland-check-policy-'));
+    try {
+        const binary = join(dir, 'executor');
+        const { GOOS: _os, GOARCH: _arch, ...host } = env;
+        const build = spawnSync('go', ['build', '-o', binary, '.'], { cwd: executorDir, env: { ...host, GOTOOLCHAIN: PINNED_GO_TOOLCHAIN, GOFLAGS: '', GOWORK: 'off', CGO_ENABLED: '0' }, encoding: 'utf8' });
+        if (build.error || build.status !== 0)
+            throw new Error(`[EXECUTOR_BUILD_FAILED] Building the SDK executor for this host to check the policy failed. ${PINNED_GO_HINT}\n${build.stderr || build.error?.message}`);
+        const result = spawnSync(binary, [CHECK_POLICY, '--package', pkg], { input: policyText, encoding: 'utf8' });
+        if (result.status === 0)
+            return undefined;
+        const reason = /^executor: (.*)$/m.exec(result.stderr ?? '')?.[1];
+        if (result.status === 1 && reason)
+            return reason;
+        throw new Error(`[EXECUTOR_BUILD_FAILED] executor ${CHECK_POLICY} did not run: ${result.stderr || result.error?.message}`);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+/** Where in dsm-package.yaml each executor refusal comes from. */
+const POLICY_FIX = [
+    [/policy (root|stop|purge)/, 'fix root.programs (schema, run, job), root.stop or uninstall.purge in dsm-package.yaml'],
+    [/policy (scope|operation|destination|move|lifetime)/, 'fix capabilities.delegate in dsm-package.yaml'],
+    [/policy portal/, 'fix portal in dsm-package.yaml'],
+    [/policy entry/, 'fix entry in dsm-package.yaml'],
+];
+/** The EXECUTOR_POLICY_REJECTED message for a policy the SDK executor refuses; undefined when it accepts it. */
+export function executorPolicyProblem(executorDir, sdkVersion, pkg, policyText, env = process.env) {
+    const reason = executorPolicyRefusal(executorDir, pkg, policyText, env);
+    if (!reason)
+        return undefined;
+    const fix = POLICY_FIX.find(([pattern]) => pattern.test(reason))?.[1] ?? 'fix the declaration in dsm-package.yaml';
+    return `The executor of SDK ${sdkVersion} refuses this App's policy (executor: ${reason}), so the NAS would refuse it at approval: ${fix}.`
+        + ' If dsm-package.yaml already matches the manifest reference, this CLI and the SDK disagree: use the SDK version this CLI release names.';
+}
+/** The policy of each architecture `check` would build, checked by the App's SDK executor; Apps without executor need none. */
+export function manifestPolicyProblem(m, env = process.env) {
+    if (!m.capabilities.delegate && !m.capabilities.rootOps)
+        return undefined;
+    try {
+        const sdk = requiredSdk(sdkBackend(m), env);
+        for (const text of new Set(m.arches.map(arch => executorPolicyText(executorPolicy(m, arch))))) {
+            const message = executorPolicyProblem(sdk.executorDir, sdk.version, m.package, text, env);
+            if (message)
+                return { code: 'EXECUTOR_POLICY_REJECTED', message };
+        }
+    }
+    catch (error) {
+        const coded = /^\[([A-Z0-9_]+)\] ([\s\S]*)$/.exec(error.message);
+        return { code: coded?.[1] ?? 'EXECUTOR_BUILD_FAILED', message: coded?.[2] ?? error.message };
+    }
+    return undefined;
+}

package/dist/standalone/dsm-window.js

@@ -72,6 +72,15 @@ export function entryLauncherAccess(entry) {
 export function appTitle(manifest) {
     return { displayname: manifest.displayname, description: manifest.description, info: manifest.i18n?.info };
 }
+/** The app name by locale, as `ui/texts` names the window: `createI18n(lang, ...).t("app_title")`. */
+function displayNameCatalogs(manifest) {
+    const catalogs = { en: { app_title: manifest.displayname } };
+    for (const [locale, text] of Object.entries(manifest.i18n?.info ?? {})) {
+        if (text?.displayname)
+            catalogs[locale] = { app_title: text.displayname };
+    }
+    return catalogs;
+}
 /** `ui/config`: registers the DSM main-menu app and its window class. */
 export function renderUiConfig(manifest, icons = packageIcons(manifest.icon)) {
     const icon = windowIconTemplate(icons);
@@ -268,7 +277,7 @@ ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
         root.lang = i18n.locale;
         try {
           me.mounted = app.mount(root, Ext.apply(ctx, {
-          displayName: ${JSON.stringify(manifest.displayname)},
+          displayName: ${ns}.createI18n(lang, ${JSON.stringify(displayNameCatalogs(manifest))}).t("app_title"),
           call: call,
           files: {endpoint: ${JSON.stringify(cgiUrl(pkg))}, token: function () { return SYNO.SDS.Session && SYNO.SDS.Session.SynoToken; }},
           reopen: me.reopenEvents.subscribe,

package/dist/validate.js

@@ -9,6 +9,7 @@ import { classifyComposeRoute, collectComposeInterpolations, collectVolumeSource
 import { usesAuthGateway } from "./contract/web-launch.js";
 import { isNativeLayout, loadNativeLayout } from "./standalone/native-layout.js";
 import { loadStandaloneManifest } from "./standalone/manifest.js";
+import { manifestPolicyProblem } from "./runtime/executor-policy-check.js";
 import { COMPOSE_FILENAME, CONTRACT_FILENAME, DSM_PACKAGE_FILENAME, } from "./discovery.js";
 import { declaredPrivilegeFlags } from "./compose/privilege.js";
 export function validateProject(project, options = {}) {
@@ -29,7 +30,9 @@ export function validateProject(project, options = {}) {
     }
     if (hasStandalone) {
         const loaded = isNativeLayout(project.root) ? loadNativeLayout(project.root) : loadStandaloneManifest(project.root);
-        return loaded.ok ? { ok: true, errors: [] } : { ok: false, errors: loaded.errors.map(error => ({
+        const policy = loaded.ok && "capabilities" in loaded.manifest ? manifestPolicyProblem(loaded.manifest) : undefined;
+        const problems = loaded.ok ? (policy ? [policy] : []) : loaded.errors;
+        return !problems.length ? { ok: true, errors: [] } : { ok: false, errors: problems.map(error => ({
                 ...error, span: { file: DSM_PACKAGE_FILENAME, line: 1, column: 1 },
                 suggestion: getErrorCode(error.code)?.suggestion ?? "Fix the schema 2 fields and capability declarations in dsm-package.yaml.",
             })) };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -24,7 +24,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@synopackageland/templates": "0.10.1",
+    "@synopackageland/templates": "0.10.2",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "tar": "^7.4.3",