@synopackageland/cli 0.15.0 → 0.15.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.15.1 (2026-10-18)
+
+- Require explicit `DSM_E2E_SSH` for e2e tunnels and use `dsm` as the default saved-profile target; set `DSM_E2E_TARGET` to reuse an earlier target name. Anonymize internal NAS fixtures and documentation.
+- Pin templates and SDK fixtures/examples to 0.15.1. Add the 0.15.1 executor/lifecycle digest entry and retain the published 0.15.0 pins unchanged.
+- Cover package-named control.sh refusal logs and rejected `.executor` / `.policy.json` staging cleanup.
+- Executor task definitions change: Apps rebuilt with SDK 0.15.1 require one administrator reapproval after upgrade.
+
+繁中摘要：e2e tunnel 必須明確設定 `DSM_E2E_SSH`，profile 預設 target 改為 `dsm`（沿用舊 profile 時設定 `DSM_E2E_TARGET`）；清理內部 NAS 範例資訊。templates／SDK pins 同步 0.15.1；新增同版三架構 executor／lifecycle digest，保留 0.15.0 pins。驗證 control.sh 拒絕 log 的套件名與 runtime copies 清除。**task 定義改變：App 使用新 SDK 重建升級後，管理員需重新核准一次。**
+
 ## 0.15.0 (2026-10-18)
 
 - Add `synopkgland ctl` host/session management, authenticated API v1 discovery, explicit command trust, typed invocation and fixed job/pagination/NDJSON/upload flows. Commands keep App backend authorization; writes require confirmation.
@@ -329,7 +338,7 @@ before its timeout.
 - The window approval of an upgrade (outdated tasks) makes 11 scheduler calls
   instead of 12: the outdated boot task is deleted by the approval's own first
   EventScheduler get, made moments before the password, instead of a second
-  get (2.9 s on vt-nas in t-0484). The control task is still read again by id
+  get (2.9 s on the test NAS in t-0484). The control task is still read again by id
   before its delete (spec/scheduler/v1). A fresh approval stays at 8.
   繁中：升級核准的排程呼叫由 12 降為 11（boot 任務不再於刪除前重讀）。
 - A scope approval reads the executor's selection back every second at most

package/README.md

@@ -150,12 +150,17 @@ await dismissNotifications(); // when a card shows later
 ```
 
 `runWithTunnel` (the `tunnel --` command) opens an SSH tunnel to the NAS
-(`DSM_E2E_SSH`, default `root@vt-nas.syno`) on a free loopback port and runs the
+(`DSM_E2E_SSH`, required, e.g. `admin@nas.example`) on a free loopback port and runs the
 command with `DSM_E2E_URL` set. It masks DSM's session cookies (`id`, `did`,
 `_SSID`), `X-SYNO-TOKEN`, `SynoToken` and `_sid` as `***` in the command's
 output and in the files under `DSM_E2E_OUTPUT_DIR` (default `.e2e`), and makes
 that directory private (700, files 600); saved sessions keep their cookies.
-Accounts come from mode 600 files named by `DSM_E2E_ACCOUNT_<USER>`.
+Set `DSM_E2E_SSH` to your NAS SSH destination in the environment or a local
+untracked `.env`; an unset or blank value fails before SSH or the command starts.
+`nas.example` is a fixture hostname; replace it with your own host. Accounts come
+from mode 600 files named by `DSM_E2E_ACCOUNT_<USER>`. Saved profiles use
+`DSM_E2E_TARGET` (default `dsm`) and the user as their names; set the target to
+an existing profile's target name to keep reusing it.
 `signIn` and `openDesktop` also register those values as e2e secrets in the
 test's worker, so e2e masks them in its own report. A test that forwards
 requests with `context.route` and `route.fetch` should end with

package/dist/contract/unsupported-types.js

@@ -3,7 +3,7 @@ import { collectInstallParameters } from "./load.js";
  * Install parameter types that the schema still accepts but that have no working
  * install path on the live package-only route.
  *
- * Measured on vt-nas 2026-08-27: both end in DSM broken/150 with no Container
+ * Measured on the test NAS 2026-08-27: both end in DSM broken/150 with no Container
  * Manager project, while a no-parameter control package installed fine on the
  * same NAS. `secret` renders its password field and fails; `homes` renders no
  * input at all. `check` reports these as warnings so build keeps working

package/dist/contract/validate.js

@@ -33,7 +33,7 @@ export function validateContract(parsed, contractFile) {
     }
     // DSM 7.4 Package Center refuses an SPK whose package identity exceeds 32
     // characters -- "Invalid file format", before the install starts and with
-    // nothing written to synopkg.log. Measured on 10.17.83.200: 32 installs, 33
+    // nothing written to synopkg.log. Measured on a DSM 7.4 test NAS: 32 installs, 33
     // does not.
     if (typeof contract.package === "string" && contract.package.length > DSM_PACKAGE_IDENTITY_MAX) {
         const pos = getValuePosition(doc, ["package"]) ?? { line: 1, column: 1 };
@@ -164,7 +164,7 @@ function validateInstallParameters(parsed, contractFile) {
             }
         }
         // A45/A46: both types are in the schema enum but neither has a working
-        // install path on the live package-only route -- measured on vt-nas as DSM
+        // install path on the live package-only route -- measured on the test NAS as DSM
         // broken/150 with no Container Manager project, against a no-parameter
         // control that installed fine. Refusing here is what makes the failure
         // honest: `homes` used to validate, build a valid SPK, and only break at

package/dist/e2e/dsm.d.ts

@@ -17,7 +17,7 @@ type Page = ReturnType<NonNullable<ReturnType<typeof surfaceOf>>["page"]>;
 type Locator = ReturnType<Page["locator"]>;
 /** The DSM URL the browser opens: DSM_E2E_URL, else the local end of the SSH tunnel. */
 export declare function dsmUrl(env?: Env): string;
-/** ssh arguments forwarding the loopback ports of `forwards` to the NAS. */
+/** ssh arguments forwarding loopback ports to the NAS; DSM_E2E_SSH is required. */
 export declare function tunnelArgs(env?: Env): string[];
 /** A loopback port nothing listens on now, for a tunnel that names none. */
 export declare function freePort(): Promise<number>;
@@ -122,7 +122,7 @@ export declare function waitForDesktop(page?: Page): Promise<void>;
 /**
  * Closes every DSM notification card; returns how many were closed. DSM shows
  * them a moment after the desktop (the admin's "Admin account security" card
- * about 2 s later on vt-nas), so it first waits up to
+ * about 2 s later on a DSM 7.4 test NAS), so it first waits up to
  * DSM_E2E_NOTIFICATION_WAIT_MS (default 5000) for one.
  */
 export declare function dismissNotifications(page?: Page, env?: Env): Promise<number>;

package/dist/e2e/dsm.js

@@ -41,11 +41,14 @@ function forwards(env) {
         ...extra(env.DSM_E2E_TUNNEL_HTTPS_PORT, env.DSM_E2E_REMOTE_HTTPS_PORT, "443"),
     ];
 }
-/** ssh arguments forwarding the loopback ports of `forwards` to the NAS. */
+/** ssh arguments forwarding loopback ports to the NAS; DSM_E2E_SSH is required. */
 export function tunnelArgs(env = process.env) {
+    const target = env.DSM_E2E_SSH?.trim();
+    if (!target)
+        throw new Error("DSM_E2E_SSH is required to open a NAS tunnel; set it to user@nas.example (using your NAS host).");
     return ["-N", "-o", "BatchMode=yes", "-o", "ExitOnForwardFailure=yes",
         ...forwards(env).flatMap(([local, remote]) => ["-L", `127.0.0.1:${local}:127.0.0.1:${remote}`]),
-        env.DSM_E2E_SSH || "root@vt-nas.syno"];
+        target];
 }
 /** A loopback port nothing listens on now, for a tunnel that names none. */
 export function freePort() {
@@ -80,12 +83,13 @@ export async function runWithTunnel(command, outer = process.env) {
         throw new Error("runWithTunnel needs a command to run.");
     const port = Number(outer.DSM_E2E_TUNNEL_PORT || await freePort());
     const env = { ...outer, DSM_E2E_TUNNEL_PORT: String(port) };
+    const args = tunnelArgs(env);
     const ports = forwards(env).map(([local]) => Number(local));
     for (const used of ports) {
         if (await portOpen(used))
             throw new Error(`Port ${used} is already in use; name another DSM_E2E_TUNNEL_* port or close it before opening the tunnel.`);
     }
-    const ssh = spawn(env.DSM_E2E_SSH_BIN || "ssh", tunnelArgs(env), { stdio: ["ignore", "ignore", "inherit"] });
+    const ssh = spawn(env.DSM_E2E_SSH_BIN || "ssh", args, { stdio: ["ignore", "ignore", "inherit"] });
     let sshExited = false;
     ssh.once("exit", () => { sshExited = true; });
     try {
@@ -93,7 +97,7 @@ export async function runWithTunnel(command, outer = process.env) {
         for (const waiting of ports) {
             while (!(await portOpen(waiting))) {
                 if (sshExited || Date.now() > deadline)
-                    throw new Error(`The SSH tunnel to ${tunnelArgs(env).at(-1)} did not open on port ${waiting}.`);
+                    throw new Error(`The SSH tunnel to ${args.at(-1)} did not open on port ${waiting}.`);
                 await new Promise(accept => setTimeout(accept, 100));
             }
         }
@@ -364,7 +368,7 @@ const notificationCloseSelector = ".v-notification-container .v-notification-pan
 /**
  * Closes every DSM notification card; returns how many were closed. DSM shows
  * them a moment after the desktop (the admin's "Admin account security" card
- * about 2 s later on vt-nas), so it first waits up to
+ * about 2 s later on a DSM 7.4 test NAS), so it first waits up to
  * DSM_E2E_NOTIFICATION_WAIT_MS (default 5000) for one.
  */
 export async function dismissNotifications(page = dsmPage(), env = process.env) {
@@ -454,7 +458,7 @@ async function restoredSessionLive(page) {
  */
 export async function signIn(app, user = "admin", env = process.env) {
     const url = dsmUrl(env);
-    const file = profilePath(env.DSM_E2E_TARGET || "vt-nas", user, env);
+    const file = profilePath(env.DSM_E2E_TARGET || "dsm", user, env);
     const context = surface().context();
     const profile = loadProfile(file, url);
     if (profile)

package/dist/host/share-permission-lookup.d.ts

@@ -8,7 +8,7 @@ import type { SharePermissionRow } from "./share-permission.js";
  * the install proceed, while an empty list would read as a real denial and
  * refuse the install on a transport error.
  *
- * The APIs used were confirmed present on DSM 7.4 (vt-nas):
+ * The APIs used were confirmed present on DSM 7.4 (the test NAS):
  * `SYNO.Core.Share.Permission`, `SYNO.Core.Group`, `SYNO.Core.Group.Member`.
  * `SYNO.Core.User.Group` also exists on the NAS but has no generated
  * synoagentcli operation, which is why membership is derived group-by-group.

package/dist/host/share-permission.d.ts

@@ -10,7 +10,7 @@
  * extra_values directly, and share permission can change after install.
  *
  * The rows are SYNO.Core.Share.Permission v1 output verbatim. Read the tests
- * before changing the predicate: on vt-nas, `newadmin` has is_writable=false on
+ * before changing the predicate: on the test NAS, `newadmin` has is_writable=false on
  * its own row for `pkgland-p0b` and still writes there, because the
  * `administrators` group row carries the grant. A user-row-only check rejects
  * the only configuration with live proof behind it.

package/dist/host/share-permission.js

@@ -10,7 +10,7 @@
  * extra_values directly, and share permission can change after install.
  *
  * The rows are SYNO.Core.Share.Permission v1 output verbatim. Read the tests
- * before changing the predicate: on vt-nas, `newadmin` has is_writable=false on
+ * before changing the predicate: on the test NAS, `newadmin` has is_writable=false on
  * its own row for `pkgland-p0b` and still writes there, because the
  * `administrators` group row carries the grant. A user-row-only check rejects
  * the only configuration with live proof behind it.

package/dist/runtime/executor-digests.json

@@ -9,5 +9,16 @@
             "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
         },
         "goToolchain": "go1.26.9"
+    },
+    "0.15.1": {
+        "x86_64": "4f47fb43f6e60dbad064afb0bbec96dd009fa046670e2c4b590b128a855cb404",
+        "aarch64": "c903b09ad657a838f0c62b6688e65e9094572b22b969770fca92fcc3640a5364",
+        "armv7": "8178d90de7ea720530bb9496e50ed118086b0e57382d84675aadc68f482d219f",
+        "lifecycle": {
+            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
+            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
+            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
+        },
+        "goToolchain": "go1.26.9"
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -26,7 +26,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "0.15.0",
+    "@synopackageland/templates": "0.15.1",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/skills/SKILL.md

@@ -129,7 +129,7 @@ sweep forward the cancel instead of admitting it.
   `ExportExample` creates a private JSON file, calls `MoveFromStaging` once, and
   repeats the original request on repeated IDs. Review `example.go` to
   adapt a real producer; show Saved only from a protected committed receipt.
-- Wizard support is measured on vt-nas DSM 7.4 via a session-only SSH local
+- Wizard support is measured on the test NAS DSM 7.4 via a session-only SSH local
   forward. This is not proof of other DSM releases or full writer/reboot behavior.
 
 ## 開啟方式

package/skills/reference/compose.md

@@ -23,7 +23,7 @@ compose:
   network: {egress: isolated}
   # Private package binds are rejected by DSM build; keep compatible upstream named volumes.
 identity_gateway:
-  sdk: 0.15.0
+  sdk: 0.15.1
   mode: none
   access: dsm-users
   listen: {http: 28000}
@@ -151,7 +151,7 @@ declared availability readiness, LAN isolation/egress, protected grant lifecycle
 ACLs, two-user visibility and clean install/upgrade/reboot/stop/uninstall before
 calling the package supported on a NAS. No NAS is accessed by the build gate.
 
-The unified Compose contract requires SDK, CLI and templates 0.15.0. Use the published, matching versions together; the legacy packaging route and bridge publish mode are removed.
+The unified Compose contract requires SDK, CLI and templates 0.15.1. Use the published, matching versions together; the legacy packaging route and bridge publish mode are removed.
 
 Primary override files, and each included override set, must share a directory. Cross-directory override bases are rejected before loader I/O. Included implicit .env files are confined, inventoried and preserved; symlinks are rejected.
 
@@ -198,7 +198,7 @@ resources and does not migrate or delete retained data.
 Bridge web ingress uses a dedicated `sdk_ingress` internal bridge. The web service
 receives a fixed IPv4 address, and the package-account gateway connects directly
 to its declared container port. Internal bridges were reachable by package-account
-hooks in the sa3200d and vt-nas feasibility probes. No HAProxy helper, published
+hooks in feasibility probes on an SA3200D and another test NAS. No HAProxy helper, published
 container port, Docker socket or host root is required. Explicit internet egress
 still adds the existing outbound bridge; other App services retain their internal networks.
 
@@ -231,7 +231,7 @@ Legacy `.sc` residue is not purged by this topology. Migrating an already publis
 installation requires a separately authorized cleanup or an official worker fix;
 a no-publish rebuild cannot claim to remove historical service registrations.
 
-On vt-nas DSM 7.4/Docker 24.0.2, internal networks blocked tested external IPv4
+On the test NAS DSM 7.4/Docker 24.0.2, internal networks blocked tested external IPv4
 and external DNS, but allowed NAS host services through the bridge gateway and
 NAS LAN address. Therefore `isolated` is not a host-service firewall. IPv6 had
 no usable default route on this fixture, which is not proof of an IPv6 firewall.
@@ -245,7 +245,7 @@ Set-Cookie. Other App sessions/native cookies retain their normal semantics.
 Cookies are shared across ports on the same hostname, so filtering only this
 package's SDK cookie would leak another App's SDK session to an upstream.
 
-Historical publish-topology vt-nas validation was release-blocked: the Container Manager
+Historical publish-topology validation on the test NAS was release-blocked: the Container Manager
 24.0.2-1706 docker-project worker can return profile error 1202 on update,
 which Package Center reports as postinst-worker failure 277. The owned test
 project and a real Vaultwarden package reproduced this; switching Compose
@@ -328,7 +328,7 @@ The [docker-project contract](https://help.synology.com/developer-guide/resource
 documents project deletion on PREUNINST and build flags, without a separate
 package-account profile-release option.
 
-The original isolated Header fixture on vt-nas installed and started from a
+The original isolated Header fixture on the test NAS installed and started from a
 clean configuration, then its upgrade still returned port conflict → 1202 →
 277. Historical `.sc` residue alone is therefore insufficient to explain or
 resolve that environment's upgrade failure. Preserve the timestamp/PID chain;

package/skills/reference/create.md

@@ -40,8 +40,8 @@ rootOps 與 delegate 已共用管理員 PasswordConfirm 核准的 protected exec
 backend 寫 `runtime: python|node|rust`（`runtime: go` 等同 `kind: go`）。CGI 是 SDK 的 Go runtime（`bridge/cmd/runtime`），它驗證 DSM session、entry 與 `permissions.json` 後，以套件帳號（不是 root）每個請求啟動一次 App。App 放在 ui 以外的目錄，打包成 `target/app/`，build 寫入 `bridge.json`（spec/bridge/v1）並把它與 `permissions.json` 的 sha256 編進 runtime。
 
 ```yaml
-backend: {runtime: python, dir: app, entry: main.py, sdk: 0.15.0}
-backend: {runtime: node, dir: app, entry: main.mjs, sdk: 0.15.0, node: {package: Node.js_v20}}
+backend: {runtime: python, dir: app, entry: main.py, sdk: 0.15.1}
+backend: {runtime: node, dir: app, entry: main.mjs, sdk: 0.15.1, node: {package: Node.js_v20}}
 backend: {runtime: rust, dir: app, entry: hello, methods: [hello.greet]}
 ```
 
@@ -213,7 +213,7 @@ sweep forward the cancel instead of admitting it.
   `ExportExample` creates a private JSON file, calls `MoveFromStaging` once, and
   repeats the original request on repeated IDs. Review `example.go` to
   adapt a real producer; show Saved only from a protected committed receipt.
-- Wizard support is measured on vt-nas DSM 7.4 via a session-only SSH local
+- Wizard support is measured on the test NAS DSM 7.4 via a session-only SSH local
   forward. This is not proof of other DSM releases or full writer/reboot behavior.
 
 ## 開啟方式

package/skills/reference/files.md

@@ -118,7 +118,7 @@ sweep forward the cancel instead of admitting it.
   `ExportExample` creates a private JSON file, calls `MoveFromStaging` once, and
   repeats the original request on repeated IDs. Review `example.go` to
   adapt a real producer; show Saved only from a protected committed receipt.
-- Wizard support is measured on vt-nas DSM 7.4 via a session-only SSH local
+- Wizard support is measured on the test NAS DSM 7.4 via a session-only SSH local
   forward. This is not proof of other DSM releases or full writer/reboot behavior.
 
 The pinned scope-selection task also binds the protected generation observed before confirmation. The executor compares it under the publish lock and refuses stale tasks, so a retained task cannot replay an older selection after another confirmation.