@synopackageland/cli 0.10.9 → 0.10.10

package/CHANGELOG.md

@@ -1,28 +1,39 @@
 # Changelog
 
+## 0.10.10 (2026-10-15)
+
+- Uses SDK 0.10.10, templates 0.10.11 and UI 0.9.9. `init` pins these versions for the generated project, and the executor digest table pins SDK 0.10.10 for x86_64, aarch64 and armv7.
+- The shared DSM window wrapper waits for the SDK session helper before backend and DSM WebAPI calls. A portal window without a desktop SynoToken obtains the current token through a shared same-origin request; cookie, token, principal and original client-address validation remain enforced.
+- Every Go child process merges `github.com/synopackageland/*` into its effective `GOPRIVATE`, `GONOPROXY` and `GONOSUMDB`, preserving environment and `go env -w` settings. Git credentials are needed to fetch the private SDK. Direct `go get` commands supply their own GOPRIVATE setting.
+- SDK approval components explain the requested system privileges with a single consent card, expandable details and inline password errors. `ExecutorApproval`, `ExecutorNotice` and `ExecutorSettings` take `purpose`; background-save settings use one save-folder row per destination key. See the SDK CHANGELOG for translation-key and slot changes.
+- App pins: `@synopackageland/cli` 0.10.10 with its lockfile; SDK 0.10.10 for Go, npm, Cargo and `backend.sdk`; UI 0.9.9. Rebuild the App. An unchanged policy and a matching root-owned INFO anchor preserve an existing approval; policy or capability changes require administrator approval.
+
+繁中摘要：使用 SDK 0.10.10、templates 0.10.11、UI 0.9.9 與三架構新 executor digest。portal 缺少 token 時，視窗 wrapper 先等待共用 SDK helper 取得 token，再呼叫後端與 DSM WebAPI，維持驗證。所有 Go 子行程自動合併 private namespace 並保留既有設定。核准畫面使用 consent 卡片，元件可傳入 `purpose`；背景存檔設定每個 key 只有一列存放資料夾。App 更新 exact pin 與 lock 後重建。
+
 ## 0.10.9 (2026-10-15)
 
 Builds with SDK 0.10.9 and templates 0.10.10: `init` writes SDK v0.10.9,
 `@synopackageland/sdk` 0.10.9 and `@synopackageland/ui` 0.9.8, and the root-ops
 template's `ExecutorGate.vue` passes `preload`. The executor digest table adds
 SDK 0.10.8 and 0.10.9 (equal to each other; the executor changed in 0.10.8).
-**An App moved from SDK 0.10.7 or earlier and rebuilt is approved once more
-by an administrator after the upgrade**, since its executor digest changes.
+An executor upgrade keeps the existing approval when the policy is unchanged
+and the new executor matches its root-owned INFO anchor. A policy or capability
+change requires an administrator's approval again.
 The CLI still needs SDK 0.10.5 or later: an executor without `tasks` (before
-0.10.8) is read back by the window as before. Use SDK 0.10.9, not 0.10.8:
-0.10.8's `ExecutorApproval` kept its loading text beside the pages without an
-executor setup.
+0.10.8) receives the window's full readback. Without an executor setup,
+SDK 0.10.9's `ExecutorApproval` shows the pages alone, with or without `preload`.
 
 To upgrade an App: devDependency `@synopackageland/cli` 0.10.9 (exact) with
 its lockfile; an App that depends on the SDK directly moves to 0.10.9 (Go
 `require github.com/synopackageland/syno-pkg-land-sdk v0.10.9` with go.sum,
 `@synopackageland/sdk` and `@synopackageland/app` 0.10.9, Cargo tag
-`v0.10.9`, `backend.sdk: 0.10.9`); then rebuild, upgrade, and approve once.
+`v0.10.9`, `backend.sdk: 0.10.9`); then rebuild and upgrade. An unchanged
+policy and matching root-owned INFO anchor preserve the existing approval.
 
 繁中摘要：搭配 SDK 0.10.9、templates 0.10.10（UI 0.9.8）。digest 表新增 SDK 0.10.8／0.10.9
-（兩者相同，executor 在 0.10.8 改變）。自 SDK 0.10.7 以前升級並重建的 App，升級後要由管理員
-重新核准一次。SDK 下限維持 0.10.5（沒有 `tasks` 的舊 executor 照舊完整核對）。請用 SDK 0.10.9，
-不要用 0.10.8。App 要改：`@synopackageland/cli` 0.10.9＋lock；直接依賴 SDK 的 App 升到 0.10.9。
+（兩者相同，executor 在 0.10.8 改變）。policy 不變且新 executor 符合 root-owned INFO anchor 時，
+升級沿用原核准；policy／能力改變才需管理員重新核准。SDK 下限維持 0.10.5（沒有 `tasks` 的舊 executor 完整核對）。沒有 executor setup 時，SDK 0.10.9 只顯示頁面。
+App 要改：`@synopackageland/cli` 0.10.9＋lock；直接依賴 SDK 的 App 升到 0.10.9。
 
 - The DSM window shows an administrator the App without reading Task
   Scheduler and EventScheduler when the pinned, running executor's status
@@ -42,7 +53,8 @@ its lockfile; an App that depends on the SDK directly moves to 0.10.9 (Go
 Builds with SDK 0.10.7 and templates 0.10.8, as 0.10.7 did: `init` still
 writes SDK v0.10.7, `@synopackageland/sdk` 0.10.7 and `@synopackageland/ui`
 0.9.8, and the executor digest table is unchanged, so an App rebuilt on it
-keeps its approval unless its executor or policy changes. Only the DSM
+keeps its approval when the policy is unchanged and the executor matches its
+root-owned INFO anchor. A policy or capability change requires approval again. Only the DSM
 window's `ctx.call` changes. The CLI still needs SDK 0.10.5 or later: the
 SDK's Gate, `useLifecycleRetry`, `appLifecycle` and `ExecutorApproval` already
 read an `APP_STOPPED` that arrives at once and check again; SDK 0.10.7 changed

package/README.md

@@ -55,10 +55,11 @@ The CLI packages, deploys and checks. The app-side code is the SDK
 and checks it against the digests shipped in this CLI. A CLI builds the SDK releases of its own minor version
 (CLI X.Y.z builds SDK X.Y.*) that its digest table records; `EXECUTOR_DIGEST_MISMATCH` names the ones it knows.
 
-The SDK repositories are private for now, so Go cannot fetch them from proxy.golang.org. Set
-`go env -w GOPRIVATE=github.com/synopackageland/*` and give git a credential that can read
-`https://github.com/synopackageland/syno-pkg-land-sdk` (check with `git ls-remote`); a failed
-fetch reports `SDK_DOWNLOAD_FAILED` with the step that is missing.
+The SDK repositories are private. The CLI adds `github.com/synopackageland/*` to its Go
+children's `GOPRIVATE`, `GONOPROXY` and `GONOSUMDB`, preserving existing environment and
+`go env -w` settings. Give git a credential that can read
+`https://github.com/synopackageland/syno-pkg-land-sdk` (check with `git ls-remote`);
+a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
 `init` and `add` read their templates from `@synopackageland/templates`, an exact-pinned
 dependency. For development against local checkouts, set `SYNOPKGLAND_TEMPLATES_DIR` to a

package/dist/build-spk/gateway.js

@@ -1,3 +1,4 @@
+import { goChildEnv } from "../runtime/go-env.js";
 import { chmodSync, copyFileSync, mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { checkCgiBinary } from "../standalone/binary.js";
@@ -29,7 +30,7 @@ export async function buildGatewayBinary(input) {
     const ldflags = ["-s", "-w", "-buildid=", `-X main.packageID=${input.packageId}`, `-X 'main.configJSON=${JSON.stringify(input.config)}'`].join(" ");
     const result = await (input.run ?? runCommand)("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, "."], {
         cwd: goAssetDir("gateway"),
-        env: { ...process.env, ...pinnedGoBuildEnv(input.arch) },
+        env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(input.arch) }),
     });
     if (result.missing) {
         return { error: "GATEWAY_GO_MISSING", detail: `The go command was not found. Building the DSM verification gateway needs Go 1.21 or later (https://go.dev/dl/). ${PINNED_GO_HINT}` };

package/dist/error-registry.js

@@ -657,7 +657,7 @@ export const ERROR_REGISTRY = {
     "STANDALONE_GO_BUILD_FAILED": {
         "code": "STANDALONE_GO_BUILD_FAILED",
         "description": "go build failed.",
-        "suggestion": "Run go build ./... in the backend directory and fix the errors. If github.com/synopackageland/syno-pkg-land-sdk is unreachable, set GOPRIVATE=github.com/synopackageland/* and make sure git can read github.com with credentials."
+        "suggestion": "Run go build ./... in the backend directory and fix the errors. If github.com/synopackageland/syno-pkg-land-sdk is unreachable, make sure git can read github.com with credentials (verify with git ls-remote)."
     },
     "STANDALONE_PORTAL_INVALID": {
         "code": "STANDALONE_PORTAL_INVALID",
@@ -788,7 +788,7 @@ for (const [code, description, suggestion] of [
     ["SDK_VERSION_MISMATCH", "The @synopackageland/sdk in frontend/package.json differs from the SDK version the backend requires (backend/go.mod or backend/Cargo.lock).", "Make both sides the same version; for a file: dependency the comparison uses that directory's package.json version."],
     ["SDK_UNSUPPORTED", "The SDK the backend requires (backend/go.mod or backend/Cargo.lock) is not on this CLI's minor line.", "Use a CLI on the same minor as the SDK, or raise the SDK to a version line the CLI supports (listed in the message)."],
     ["SDK_DIR_NOT_READY", "The SDK checkout SYNOPKGLAND_SDK_DIR points at has no go.mod, or the ts package a Vue project needs is not built (no ts/dist).", "Point at a syno-pkg-land-sdk checkout; for a Vue project first run npm ci && npm run build in $SYNOPKGLAND_SDK_DIR/ts (npm does not build file: packages for you)."],
-    ["SDK_DOWNLOAD_FAILED", "go mod download cannot fetch the SDK version backend/go.mod requires.", "The SDK repo is private and cannot go through proxy.golang.org: set GOPRIVATE=github.com/synopackageland/* (for example go env -w) and make sure git can read github.com with credentials (verify with git ls-remote); then confirm the version exists. Offline, run go mod download once on the same machine first."],
+    ["SDK_DOWNLOAD_FAILED", "go mod download cannot fetch the SDK version backend/go.mod requires.", "The CLI fetches the private SDK with git: make sure git can read github.com with credentials (verify with git ls-remote), then confirm the version exists. Offline, run go mod download once on the same machine first."],
     ["TEMPLATES_MISSING", "@synopackageland/templates was not found.", "Reinstall @synopackageland/cli, or point SYNOPKGLAND_TEMPLATES_DIR at a templates checkout."],
     ["EXECUTOR_PIN_REQUIRED", "A package that declares rootOps or delegate was built without the executor artifact.", "Use synopkgland build so the CLI compiles and pins the executor; do not call the low-level SPK API directly."],
     ["EXECUTOR_POLICY", "capabilities.delegate has invalid operations or scope, or a binary root program lacks the file for this architecture, so the executor policy cannot be generated.", "Use the delegate declaration init/add produces and fix scope and operations against the manifest reference; for binary root programs provide root/<arch>/<name> for every arch in arches."],

package/dist/init.js

@@ -1,3 +1,4 @@
+import { goChildEnv } from "./runtime/go-env.js";
 import { spawnSync } from "node:child_process";
 import { isMap, isScalar, parse, parseDocument } from "yaml";
 import { setTopLevel } from "./yaml-edit.js";
@@ -205,7 +206,7 @@ export function initFromTemplate(template, targetDir, options = {}) {
     if (template === "binary") {
         mkdirSync(join(targetDir, "prebuilt"), { recursive: true });
         for (const [arch, goarch] of [["x86_64", "amd64"], ["aarch64", "arm64"]]) {
-            const result = spawnSync("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", join(targetDir, "prebuilt", `api-${arch}`), "main.go"], { cwd: join(targetDir, "example"), env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: goarch }, encoding: "utf8" });
+            const result = spawnSync("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", join(targetDir, "prebuilt", `api-${arch}`), "main.go"], { cwd: join(targetDir, "example"), env: goChildEnv({ ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: goarch }), encoding: "utf8" });
             if (result.error || result.status !== 0)
                 throw new Error(`[INIT_BINARY_BUILD_FAILED] Install Go and run init again, or provide your own static CGI binary. ${result.stderr ?? result.error}`);
         }

package/dist/runtime/executor-build.js

@@ -1,3 +1,4 @@
+import { goChildEnv } from "./go-env.js";
 import { mkdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem } from '../build-spk/go-toolchain.js';
@@ -41,14 +42,14 @@ export async function buildExecutor(m, arch, work, run, options = {}) {
         throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', `Executor sources of SDK ${sdk.version} are missing: ${error.message}`);
     }
     const binary = join(dir, 'executor');
-    const result = await run('go', [...GO_BUILD, binary, '.'], { cwd: source, env: { ...process.env, ...pinnedGoBuildEnv(arch) } });
+    const result = await run('go', [...GO_BUILD, binary, '.'], { cwd: source, env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }) });
     if (result.missing || result.status !== 0)
         throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', `Executor build failed (${arch}). ${PINNED_GO_HINT}\n${result.stderr}`);
     const problem = checkCgiBinary(work, binary, arch);
     if (problem)
         throw new StandaloneBuildError(problem.code, problem.message);
     const lifecycleBinary = join(dir, 'lifecycle');
-    const lifecycleResult = await run('go', [...GO_BUILD, lifecycleBinary, './cmd/lifecycle'], { cwd: source, env: { ...process.env, ...pinnedGoBuildEnv(arch) } });
+    const lifecycleResult = await run('go', [...GO_BUILD, lifecycleBinary, './cmd/lifecycle'], { cwd: source, env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }) });
     if (lifecycleResult.missing || lifecycleResult.status !== 0)
         throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', `Lifecycle helper build failed (${arch}). ${PINNED_GO_HINT}\n${lifecycleResult.stderr}`);
     const lifecycleProblem = checkCgiBinary(work, lifecycleBinary, arch);

package/dist/runtime/executor-digests.json

@@ -108,5 +108,16 @@
             "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
         },
         "goToolchain": "go1.26.9"
+    },
+    "0.10.10": {
+        "x86_64": "9c2c6f92edd2536b3061f8b9eef8b500a1f064909deb4c1b44b496465879b90d",
+        "aarch64": "175731dafb52b83f771878cd41407cae6353a90628649ec78118d6a1e1ffb9fb",
+        "armv7": "27402fa2aa47732a280434cefaa876b0cfe8202a6dc103fd9dd1984e9dc69c81",
+        "lifecycle": {
+            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
+            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
+            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
+        },
+        "goToolchain": "go1.26.9"
     }
 }

package/dist/runtime/executor-inspect.js

@@ -43,7 +43,7 @@ export function inspectExecutor(dir, pkg, arch) {
         return { executor: { executorDigest, policyDigest, policy, implementation: plan.implementation, sdk: plan.sdk, tasks: tasks.map(task => ({ ...task, state: 'unknown' })) }, findings: [] };
     }
     catch (e) {
-        // A failed SDK download is this machine's Go setup (GOPRIVATE), not a defect of the SPK.
+        // A failed SDK download is this machine's git access, not a defect of the SPK.
         if (e.message.startsWith('[SDK_DOWNLOAD_FAILED]'))
             throw e;
         return { findings: ['Executor inventory invalid: ' + e.message] };

package/dist/runtime/executor-policy-check.js

@@ -1,3 +1,4 @@
+import { goChildEnv } from "./go-env.js";
 import { spawnSync } from 'node:child_process';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -18,7 +19,7 @@ export function executorPolicyRefusal(executorDir, pkg, policyText, env = proces
     try {
         const binary = join(dir, 'executor');
         const { GOOS: _os, GOARCH: _arch, ...host } = env;
-        const build = spawnSync('go', ['build', '-o', binary, '.'], { cwd: executorDir, env: { ...host, GOTOOLCHAIN: PINNED_GO_TOOLCHAIN, GOFLAGS: '', GOWORK: 'off', CGO_ENABLED: '0' }, encoding: 'utf8' });
+        const build = spawnSync('go', ['build', '-o', binary, '.'], { cwd: executorDir, env: goChildEnv({ ...host, GOTOOLCHAIN: PINNED_GO_TOOLCHAIN, GOFLAGS: '', GOWORK: 'off', CGO_ENABLED: '0' }), encoding: 'utf8' });
         if (build.error || build.status !== 0)
             throw new Error(`[EXECUTOR_BUILD_FAILED] Building the SDK executor for this host to check the policy failed. ${PINNED_GO_HINT}\n${build.stderr || build.error?.message}`);
         const result = spawnSync(binary, [CHECK_POLICY, '--package', pkg], { input: policyText, encoding: 'utf8' });

package/dist/runtime/go-env.d.ts

@@ -0,0 +1,4 @@
+/** Preserve effective Go settings and add the SDK namespace only for this child. */
+export declare function goChildEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/** Whether a comma-separated GOPRIVATE-style glob list matches a module path or one of its prefixes, as go does. */
+export declare function goPrivateCovers(patterns: string, modulePath: string): boolean;

package/dist/runtime/go-env.js

@@ -0,0 +1,57 @@
+import { spawnSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+const SDK_PRIVATE = 'github.com/synopackageland/*';
+const PRIVATE_KEYS = ['GOPRIVATE', 'GONOPROXY', 'GONOSUMDB'];
+/** Preserve effective Go settings and add the SDK namespace only for this child. */
+export function goChildEnv(env = process.env) {
+    const configured = readGoEnv(env);
+    const child = { ...env };
+    const privatePatterns = env.GOPRIVATE || configured.GOPRIVATE || '';
+    for (const key of PRIVATE_KEYS) {
+        const patterns = env[key] || configured[key] || privatePatterns;
+        child[key] = coversSdkNamespace(patterns) ? patterns : [patterns, SDK_PRIVATE].filter(Boolean).join(',');
+    }
+    return child;
+}
+/** A match for one module (such as `?`) does not cover every SDK module. */
+function coversSdkNamespace(patterns) {
+    return patterns.split(',').some(pattern => {
+        const glob = pattern.replace(/\/+$/, '');
+        const parts = glob.split('/');
+        if (parts.length <= 2)
+            return goPrivateCovers(glob, 'github.com/synopackageland');
+        return parts.length === 3 && /^\*+$/.test(parts[2]) && goPrivateCovers(glob, SDK_PRIVATE);
+    });
+}
+/** Bootstrap read: use the original environment to preserve go env -w settings. */
+function readGoEnv(env) {
+    const result = spawnSync('go', ['env', '-json', ...PRIVATE_KEYS], {
+        cwd: tmpdir(), env: { ...env, GOFLAGS: '', GOTOOLCHAIN: 'local' }, encoding: 'utf8', timeout: 10_000,
+    });
+    if (result.status !== 0)
+        return {};
+    try {
+        return JSON.parse(result.stdout);
+    }
+    catch {
+        return {};
+    }
+}
+/** Whether a comma-separated GOPRIVATE-style glob list matches a module path or one of its prefixes, as go does. */
+export function goPrivateCovers(patterns, modulePath) {
+    const elements = modulePath.split('/');
+    return patterns.split(',').map(glob => glob.replace(/\/+$/, '')).filter(Boolean).some(glob => {
+        const prefix = elements.slice(0, glob.split('/').length).join('/');
+        try {
+            return globRegExp(glob).test(prefix);
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/** path.Match syntax: `*` and `?` never cross a slash. */
+function globRegExp(glob) {
+    const body = glob.replace(/[.+^${}()|\\]/g, '\\$&').replaceAll('*', '[^/]*').replaceAll('?', '[^/]');
+    return new RegExp(`^${body}$`);
+}

package/dist/runtime/sdk-session.d.ts

@@ -0,0 +1,2 @@
+/** The SDK's plain browser factory, embedded without imposing a TS build on Go Apps. */
+export declare function appSdkSessionRuntime(backend: object, env?: NodeJS.ProcessEnv): string;

package/dist/runtime/sdk-session.js

@@ -0,0 +1,23 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { appSdkVersion, sdkBelowFloor, sdkSource } from './sdk-source.js';
+/** The SDK's plain browser factory, embedded without imposing a TS build on Go Apps. */
+export function appSdkSessionRuntime(backend, env = process.env) {
+    if (backend.kind === 'binary')
+        return '';
+    const version = appSdkVersion(backend);
+    if (!version || sdkBelowFloor(version))
+        return '';
+    const sdk = sdkSource(version, env);
+    let source;
+    try {
+        source = readFileSync(join(sdk.goDir, 'ts/src/dsm/session.js'), 'utf8');
+    }
+    catch (error) {
+        // Older supported SDKs retain their desktop-only carrier behavior.
+        if (error.code === 'ENOENT')
+            return '';
+        throw error;
+    }
+    return source.replace(/^export function createDsmSession\(/m, 'function createDsmSession(');
+}

package/dist/runtime/sdk-source.d.ts

@@ -1,3 +1,4 @@
+export { goPrivateCovers } from './go-env.js';
 export declare const SDK_PACKAGE = "@synopackageland/sdk";
 export declare const SDK_MODULE = "github.com/synopackageland/syno-pkg-land-sdk";
 export declare const EXECUTOR_MODULE = "github.com/synopackageland/syno-pkg-land-sdk/executor";
@@ -43,10 +44,5 @@ export declare function sdkSource(version: string, env?: NodeJS.ProcessEnv, down
 export declare function goModDownload(spec: string, env?: NodeJS.ProcessEnv): string;
 /** The SDK an App builds its executor with; delegate and rootOps cannot build without one. */
 export declare function requiredSdk(backend: SdkBackend, env?: NodeJS.ProcessEnv, download?: (spec: string) => string): SdkSource;
-/**
- * The SDK repositories are private: Go must fetch them with git, not from
- * proxy.golang.org and sum.golang.org. Says which of the two is missing.
- */
-export declare function privateSdkHint(env?: NodeJS.ProcessEnv): string;
-/** Whether a comma-separated GOPRIVATE-style glob list matches a module path or one of its prefixes, as go does. */
-export declare function goPrivateCovers(patterns: string, modulePath: string): boolean;
+/** Go children fetch the private SDK directly; failed fetches need git credentials. */
+export declare function privateSdkHint(): string;

package/dist/runtime/sdk-source.js

@@ -1,4 +1,6 @@
 import { spawnSync } from 'node:child_process';
+import { goChildEnv } from './go-env.js';
+export { goPrivateCovers } from './go-env.js';
 import { readFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
@@ -91,14 +93,14 @@ export function goModDownload(spec, env = process.env) {
     const cached = downloaded.get(key);
     if (cached)
         return cached;
-    const result = spawnSync('go', ['mod', 'download', '-json', spec], { cwd: tmpdir(), env: { ...env, GOWORK: 'off', GOFLAGS: '' }, encoding: 'utf8' });
+    const result = spawnSync('go', ['mod', 'download', '-json', spec], { cwd: tmpdir(), env: goChildEnv({ ...env, GOWORK: 'off', GOFLAGS: '' }), encoding: 'utf8' });
     let info = {};
     try {
         info = JSON.parse(result.stdout);
     }
     catch { /* reported below */ }
     if (result.error || result.status !== 0 || !info.Dir) {
-        throw new Error(`[SDK_DOWNLOAD_FAILED] go mod download ${spec} failed: ${info.Error ?? result.stderr ?? result.error?.message}${privateSdkHint(env)}`);
+        throw new Error(`[SDK_DOWNLOAD_FAILED] go mod download ${spec} failed: ${info.Error ?? result.stderr ?? result.error?.message}${privateSdkHint()}`);
     }
     downloaded.set(key, info.Dir);
     return info.Dir;
@@ -110,33 +112,7 @@ export function requiredSdk(backend, env = process.env, download) {
         throw new Error(`[SDK_REQUIRED] capabilities.delegate and rootOps need the SDK: ${SDK_DEPENDENCY[backend.kind]}`);
     return download ? sdkSource(version, env, download) : sdkSource(version, env);
 }
-/**
- * The SDK repositories are private: Go must fetch them with git, not from
- * proxy.golang.org and sum.golang.org. Says which of the two is missing.
- */
-export function privateSdkHint(env = process.env) {
-    const result = spawnSync('go', ['env', '-json', 'GONOPROXY', 'GONOSUMDB'], { cwd: tmpdir(), env: { ...env, GOFLAGS: '' }, encoding: 'utf8' });
-    let goEnv = {};
-    try {
-        goEnv = JSON.parse(result.stdout);
-    }
-    catch { /* treated as not covered */ }
-    if (goPrivateCovers(goEnv.GONOPROXY ?? '', SDK_MODULE) && goPrivateCovers(goEnv.GONOSUMDB ?? '', SDK_MODULE)) {
-        return ` GOPRIVATE covers the SDK, so Go fetches it with git: check that \`git ls-remote https://${SDK_MODULE}\` works with your git credential.`;
-    }
-    return ' The SDK repositories are private, and Go looks up modules outside GOPRIVATE on proxy.golang.org and sum.golang.org.'
-        + ' Set GOPRIVATE=github.com/synopackageland/* (for example `go env -w GOPRIVATE=github.com/synopackageland/*`) and give git a credential for github.com.';
-}
-/** Whether a comma-separated GOPRIVATE-style glob list matches a module path or one of its prefixes, as go does. */
-export function goPrivateCovers(patterns, modulePath) {
-    const elements = modulePath.split('/');
-    return patterns.split(',').map(glob => glob.trim().replace(/\/+$/, '')).filter(Boolean).some(glob => {
-        const prefix = elements.slice(0, glob.split('/').length).join('/');
-        return globRegExp(glob).test(prefix);
-    });
-}
-/** path.Match syntax: `*` and `?` never cross a slash. */
-function globRegExp(glob) {
-    const body = glob.replace(/[.+^${}()|\\]/g, '\\$&').replaceAll('*', '[^/]*').replaceAll('?', '[^/]');
-    return new RegExp(`^${body}$`);
+/** Go children fetch the private SDK directly; failed fetches need git credentials. */
+export function privateSdkHint() {
+    return ` Check that \`git ls-remote https://${SDK_MODULE}\` works with your git credential.`;
 }

package/dist/standalone/bridge-runtime.js

@@ -1,3 +1,4 @@
+import { goChildEnv } from "../runtime/go-env.js";
 import { join } from "node:path";
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem } from "../build-spk/go-toolchain.js";
 import { requiredSdk, SDK_MODULE } from "../runtime/sdk-source.js";
@@ -29,7 +30,7 @@ export async function buildBridgeRuntime(m, arch, work, run, digests) {
     ].join(" ");
     const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, RUNTIME_MAIN], {
         cwd: sdk.goDir,
-        env: { ...process.env, ...pinnedGoBuildEnv(arch) },
+        env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }),
     });
     if (result.missing)
         throw new StandaloneBuildError("STANDALONE_GO_MISSING", "The go command was not found. The Python, Node and Rust App runtime is compiled from the SDK's Go source; install Go 1.21 or later (https://go.dev/dl/).");

package/dist/standalone/build.js

@@ -1,3 +1,4 @@
+import { goChildEnv } from "../runtime/go-env.js";
 import { spawn } from "node:child_process";
 import { goModulePath, privateSdkHint, SDK_MODULE, sdkSource } from "../runtime/sdk-source.js";
 import { existsSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
@@ -175,7 +176,7 @@ async function buildGoCgi(manifest, backend, arch, work, run) {
     ].join(" ");
     const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, backend.main], {
         cwd: backend.dir,
-        env: { ...process.env, ...goBuildEnv(arch) },
+        env: goChildEnv({ ...process.env, ...goBuildEnv(arch) }),
     });
     if (result.missing) {
         throw new StandaloneBuildError("STANDALONE_GO_MISSING", "The go command was not found. Install Go 1.25 or later (https://go.dev/dl/), or package an existing executable with backend.binary.");
@@ -196,7 +197,7 @@ async function buildBackgroundWorker(manifest, arch, work, run) {
     ].join(" ");
     const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, BACKGROUND_WORKER_MAIN], {
         cwd: manifest.backend.dir,
-        env: { ...process.env, ...goBuildEnv(arch) },
+        env: goChildEnv({ ...process.env, ...goBuildEnv(arch) }),
     });
     if (result.missing || result.status !== 0) {
         throw new StandaloneBuildError("STANDALONE_BACKGROUND_BUILD_FAILED", `background worker (${BACKGROUND_WORKER_MAIN}) build failed; this project's backend must contain that package.\n${result.stderr}`);

package/dist/standalone/daemon.js

@@ -1,3 +1,4 @@
+import { goChildEnv } from "../runtime/go-env.js";
 import { chmodSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem } from "../build-spk/go-toolchain.js";
@@ -64,7 +65,7 @@ export async function buildDaemonControl(manifest, arch, work, run) {
         return undefined;
     const out = join(work, `daemon-control-${arch}`);
     const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", out, "."], {
-        cwd: goAssetDir("daemon"), env: { ...process.env, ...pinnedGoBuildEnv(arch) },
+        cwd: goAssetDir("daemon"), env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }),
     });
     if (result.missing || result.status !== 0)
         throw new StandaloneBuildError("STANDALONE_DAEMON_BUILD_FAILED", `daemon controller build failed (${arch}). ${PINNED_GO_HINT}\n${result.stderr}`);

package/dist/standalone/dsm-window.js

@@ -10,6 +10,7 @@ import { packageIcons, windowIconFile, windowIconTemplate } from "../build-spk/d
 import { DEFAULT_WINDOW, FULL_PAGE_MIN_WIDTH } from "./window-size.js";
 import { requestTimeoutSeconds } from "./request-timeout.js";
 import { appSdkTimeouts } from "../runtime/sdk-timeouts.js";
+import { appSdkSessionRuntime } from "../runtime/sdk-session.js";
 /** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
 export const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
 /**
@@ -136,10 +137,22 @@ export function renderWindowScript(manifest, assetVersion, icons = packageIcons(
     const size = manifest.ui.window ?? DEFAULT_WINDOW;
     const requestTimeout = requestTimeoutSeconds(manifest.backend) * 1000;
     const clientMargin = appSdkTimeouts(manifest.backend).browserMarginMs;
+    const sessionRuntime = appSdkSessionRuntime(manifest.backend);
     if (manifest.portal && !portalText)
         throw new Error("A portal App's window needs the SDK's portal panel text.");
     return `/* Generated by synopkgland build. Edit your UI in the project's ui folder. */
 Ext.ns(${JSON.stringify(ns)});
+${sessionRuntime ? `
+// The SDK owns recovery; all calls share one bounded, same-origin attempt.
+${ns}.session = (function () {
+${sessionRuntime}
+  return createDsmSession({
+    read: function () { return SYNO.SDS.Session && SYNO.SDS.Session.SynoToken; },
+    write: function (token) { SYNO.SDS.Session = SYNO.SDS.Session || {}; SYNO.SDS.Session.SynoToken = token; },
+    fetch: function (url, options) { return fetch(url, options); }
+  });
+})();
+` : ''}
 
 // The SDK's clientTimeout: past the backend's request deadline
 // (ctx.requestTimeout, from backend.timeout_seconds), so its request_timeout
@@ -169,8 +182,10 @@ ${ns}.callOnce = function (method, params, options, requestTimeout) {
   var done = function () {
     clearTimeout(timer);
     if (signal) signal.removeEventListener("abort", leave);
+    if (recoveryCanceled) controller.signal.removeEventListener("abort", recoveryCanceled);
   };
-  return fetch(${JSON.stringify(cgiUrl(pkg))}, {
+  var recoveryCanceled;
+  var dispatch = function () { return fetch(${JSON.stringify(cgiUrl(pkg))}, {
     method: "POST",
     credentials: "same-origin",
     headers: headers,
@@ -182,7 +197,20 @@ ${ns}.callOnce = function (method, params, options, requestTimeout) {
     });
   }, function () {
     return { success: false, error: failure || { code: "network", message: "The NAS did not answer" } };
-  }).then(function (body) {
+  }); };
+  var request;
+  if (!token && ${ns}.session) {
+    var canceledRecovery = new Promise(function (resolve) {
+      recoveryCanceled = function () { resolve(undefined); };
+      controller.signal.addEventListener("abort", recoveryCanceled);
+    });
+    request = Promise.race([${ns}.session.ready(), canceledRecovery]).then(function (recovered) {
+      if (failure) return { success: false, error: failure };
+      if (recovered) headers["X-SYNO-TOKEN"] = recovered;
+      return dispatch();
+    });
+  } else request = dispatch();
+  return request.then(function (body) {
     done();
     if (body && body.success === true) {
       return body.data;
@@ -404,7 +432,7 @@ function renderWebApi(ns) {
     return `// DSM WebAPI in the window's own session: resolves data, rejects {code: "dsm_<n>"}.
 ${ns}.webApi = function (win) {
   return function (api, method, version, params) {
-    return new Promise(function (resolve, reject) {
+    var send = function () { return new Promise(function (resolve, reject) {
       win.sendWebAPI({
         api: api, method: method, version: version, params: params, scope: win,
         callback: function (success, response) {
@@ -412,7 +440,8 @@ ${ns}.webApi = function (win) {
           else reject({ code: "dsm_" + ((response && response.code) || "error") });
         }
       });
-    });
+    }); };
+    return ${ns}.session && !${ns}.session.token() ? ${ns}.session.ready().then(send) : send();
   };
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.10.9",
+  "version": "0.10.10",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -25,7 +25,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@synopackageland/templates": "0.10.10",
+    "@synopackageland/templates": "0.10.11",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "tar": "^7.4.3",