@synopackageland/cli 0.15.2 → 0.15.4

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.15.4 (2026-10-18)
+
+- Fix Compose import and undeclared SDK defaults after CLI-only patch releases. Resolve the SDK from the exactly pinned templates' Go module instead of assuming the CLI and SDK share a patch version; daemon-control defaults use the same source.
+- Preserve explicit Compose and identity-gateway SDK declarations. Add subprocess regressions with differing CLI/SDK versions and no SDK source override, plus release smoke coverage for real Compose imports and headless manifests.
+- Keep templates/SDK pinned to 0.15.2 and every executor/lifecycle digest entry unchanged. Upgrade from CLI 0.15.3 to 0.15.4 to restore `init -t compose --from`; SDK/helper bytes do not change and no new administrator reapproval requirement is introduced.
+
+繁中摘要：修正 CLI 與 SDK patch 版本不同時，Compose 匯入／未宣告 SDK 的預設路徑下載不存在 SDK tag 的問題；改由固定 templates 的 Go module 讀取 SDK pin，daemon-control 預設值亦同步。保留明確 SDK 宣告的優先順序，新增無 source override 的版本拆分回歸測試與正式產物 smoke。templates／SDK 保持 0.15.2，全部 executor／lifecycle digest 不變；請由 CLI 0.15.3 升級至 0.15.4，不新增管理員重新核准要求。
+
+## 0.15.3 (2026-10-18)
+
+- Pin templates and SDK fixtures/examples to 0.15.2, including UI 0.12.0 scaffolds, concise UI copy/tokens and delegate DTO contract checks.
+- Add the SDK 0.15.2 executor/lifecycle digest entry using Go 1.26.9; retain every earlier entry unchanged. All six digests match 0.15.1, so upgrading from 0.15.1 adds no administrator reapproval requirement. Apps upgrading from 0.15.0 retain the one-time approval introduced in SDK 0.15.1.
+- Include CLI-5 shared OFF_GLOSSARY rules and CLI-6 command failure exit codes from CLI 0.15.2. CLI 0.15.2 was already published with templates 0.15.1; use 0.15.3 for the coordinated SDK/templates release.
+
+繁中摘要：templates／SDK pins 同步 0.15.2，帶入 UI 0.12.0、精簡文案／token 與 DTO 契約檢查；保留 CLI-5 詞彙規則及 CLI-6 正確退出碼。新增 SDK 0.15.2 digest 表項，六個 digest 均與 0.15.1 相同，保留全部舊 pins；從 0.15.1 升級不新增重新核准要求，從 0.15.0 升級仍需完成一次管理員核准。CLI 0.15.2 已先發佈，因此本次協同發版使用 CLI 0.15.3。
+
 ## 0.15.2 (2026-10-18)
 
 - Preserve command-set process exit codes instead of resetting them to 0 after CLI dispatch. `ctl` failures now reach scripts and CI with their documented exit codes; successful commands still exit 0 and uncaught exceptions exit 1.

package/README.md

@@ -61,6 +61,9 @@ children's `GOPRIVATE`, `GONOPROXY` and `GONOSUMDB`, preserving existing environ
 `https://github.com/synopackageland/syno-pkg-land-sdk` (check with `git ls-remote`);
 a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
+CLI-only patch releases can differ from the SDK patch. Compose import and SDK defaults
+read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
+
 `init` and `add` read their templates from `@synopackageland/templates`, an exact-pinned
 dependency. For development against local checkouts, set `SYNOPKGLAND_TEMPLATES_DIR` to a
 templates checkout and `SYNOPKGLAND_SDK_DIR` to an SDK checkout; SPKs built with

package/dist/runtime/executor-digests.json

@@ -20,5 +20,16 @@
             "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
         },
         "goToolchain": "go1.26.9"
+    },
+    "0.15.2": {
+        "x86_64": "4f47fb43f6e60dbad064afb0bbec96dd009fa046670e2c4b590b128a855cb404",
+        "aarch64": "c903b09ad657a838f0c62b6688e65e9094572b22b969770fca92fcc3640a5364",
+        "armv7": "8178d90de7ea720530bb9496e50ed118086b0e57382d84675aadc68f482d219f",
+        "lifecycle": {
+            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
+            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
+            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
+        },
+        "goToolchain": "go1.26.9"
     }
 }

package/dist/standalone/compose.js

@@ -5,7 +5,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { parse } from "yaml";
-import { CLI_VERSION } from "../cli-version.js";
+import { templateSdkVersion } from "../template-paths.js";
 import { goChildEnv } from "../runtime/go-env.js";
 import { sdkSource } from "../runtime/sdk-source.js";
 import { readDaemon } from "./daemon.js";
@@ -69,7 +69,7 @@ export function readComposeApp(value, root, arches, fail, context = {}) {
     if (value.sdk !== undefined &&
         (typeof value.sdk !== "string" || !/^\d+\.\d+\.\d+$/.test(value.sdk)))
         return invalid("compose.sdk must name the matching SDK release.", "SDK_COMPOSE_UNSUPPORTED");
-    const sdk = typeof value.sdk === "string" ? value.sdk : (context.sdk ?? CLI_VERSION);
+    const sdk = typeof value.sdk === "string" ? value.sdk : (context.sdk ?? templateSdkVersion());
     let targets = {};
     if (value.helpers !== undefined) {
         const d = readDaemon({ exec: "_sso/gateway", targets: value.helpers }, root, arches, fail);
@@ -250,7 +250,7 @@ export function lockComposeImages(m, arch, resolveImages, imageProofs) {
     return { ...m, compose };
 }
 export function composeInputs(root, file, envFile) {
-    const result = spawnSync(planner(CLI_VERSION), [
+    const result = spawnSync(planner(templateSdkVersion()), [
         "sources",
         "--root",
         root,

package/dist/standalone/daemon.js

@@ -3,7 +3,7 @@ import { chmodSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSyn
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem, } from "../build-spk/go-toolchain.js";
 import { sdkSource, appSdkVersion } from "../runtime/sdk-source.js";
-import { CLI_VERSION } from "../cli-version.js";
+import { templateSdkVersion } from "../template-paths.js";
 import { checkCgiBinary } from "./binary.js";
 import { composeDaemon, composeNetwork } from "./compose.js";
 import { gatewayDaemon } from "./identity-gateway.js";
@@ -141,7 +141,7 @@ export async function buildDaemonControl(manifest, arch, work, run) {
             (manifest.backend.kind === "go"
                 ? appSdkVersion(manifest.backend)
                 : undefined) ??
-            CLI_VERSION).goDir,
+            templateSdkVersion()).goDir,
         env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }),
     });
     if (result.missing || result.status !== 0)

package/dist/template-paths.d.ts

@@ -3,3 +3,7 @@
  * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
  */
 export declare function templatesRoot(env?: NodeJS.ProcessEnv, from?: string): string;
+/** The installed templates' SDK pin also supplies CLI-owned runtime defaults.
+ * CLI-only patch releases must never turn their own version into an SDK tag.
+ */
+export declare function templateSdkVersion(env?: NodeJS.ProcessEnv): string;

package/dist/template-paths.js

@@ -1,5 +1,6 @@
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
+import { sdkRequirement } from "./runtime/sdk-source.js";
 /**
  * The scaffold templates come from the exactly pinned @synopackageland/templates
  * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
@@ -14,3 +15,13 @@ export function templatesRoot(env = process.env, from = import.meta.url) {
         throw new Error("[TEMPLATES_MISSING] @synopackageland/templates is not installed; reinstall @synopackageland/cli, or set SYNOPKGLAND_TEMPLATES_DIR to a templates checkout.");
     }
 }
+/** The installed templates' SDK pin also supplies CLI-owned runtime defaults.
+ * CLI-only patch releases must never turn their own version into an SDK tag.
+ */
+export function templateSdkVersion(env = process.env) {
+    const version = sdkRequirement(join(templatesRoot(env), "native-go/backend"));
+    if (!version || !/^\d+\.\d+\.\d+$/.test(version)) {
+        throw new Error("[TEMPLATES_MISSING] The installed templates have no valid SDK pin; reinstall @synopackageland/templates.");
+    }
+    return version;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.15.2",
+  "version": "0.15.4",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "0.15.1",
+    "@synopackageland/templates": "0.15.2",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/skills/reference/compose.md

@@ -23,7 +23,7 @@ compose:
   network: {egress: isolated}
   # Private package binds are rejected by DSM build; keep compatible upstream named volumes.
 identity_gateway:
-  sdk: 0.15.1
+  sdk: 0.15.2
   mode: none
   access: dsm-users
   listen: {http: 28000}
@@ -151,7 +151,7 @@ declared availability readiness, LAN isolation/egress, protected grant lifecycle
 ACLs, two-user visibility and clean install/upgrade/reboot/stop/uninstall before
 calling the package supported on a NAS. No NAS is accessed by the build gate.
 
-The unified Compose contract requires SDK, CLI and templates 0.15.1. Use the published, matching versions together; the legacy packaging route and bridge publish mode are removed.
+The unified Compose contract uses SDK/templates 0.15.2 with CLI 0.15.4. Use the published, matching versions together; the legacy packaging route and bridge publish mode are removed.
 
 Primary override files, and each included override set, must share a directory. Cross-directory override bases are rejected before loader I/O. Included implicit .env files are confined, inventoried and preserved; symlinks are rejected.
 

package/skills/reference/create.md

@@ -40,8 +40,8 @@ rootOps 與 delegate 已共用管理員 PasswordConfirm 核准的 protected exec
 backend 寫 `runtime: python|node|rust`（`runtime: go` 等同 `kind: go`）。CGI 是 SDK 的 Go runtime（`bridge/cmd/runtime`），它驗證 DSM session、entry 與 `permissions.json` 後，以套件帳號（不是 root）每個請求啟動一次 App。App 放在 ui 以外的目錄，打包成 `target/app/`，build 寫入 `bridge.json`（spec/bridge/v1）並把它與 `permissions.json` 的 sha256 編進 runtime。
 
 ```yaml
-backend: {runtime: python, dir: app, entry: main.py, sdk: 0.15.1}
-backend: {runtime: node, dir: app, entry: main.mjs, sdk: 0.15.1, node: {package: Node.js_v20}}
+backend: {runtime: python, dir: app, entry: main.py, sdk: 0.15.2}
+backend: {runtime: node, dir: app, entry: main.mjs, sdk: 0.15.2, node: {package: Node.js_v20}}
 backend: {runtime: rust, dir: app, entry: hello, methods: [hello.greet]}
 ```