@synopackageland/cli 0.15.3 → 0.15.4

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.15.4 (2026-10-18)
+
+- Fix Compose import and undeclared SDK defaults after CLI-only patch releases. Resolve the SDK from the exactly pinned templates' Go module instead of assuming the CLI and SDK share a patch version; daemon-control defaults use the same source.
+- Preserve explicit Compose and identity-gateway SDK declarations. Add subprocess regressions with differing CLI/SDK versions and no SDK source override, plus release smoke coverage for real Compose imports and headless manifests.
+- Keep templates/SDK pinned to 0.15.2 and every executor/lifecycle digest entry unchanged. Upgrade from CLI 0.15.3 to 0.15.4 to restore `init -t compose --from`; SDK/helper bytes do not change and no new administrator reapproval requirement is introduced.
+
+繁中摘要：修正 CLI 與 SDK patch 版本不同時，Compose 匯入／未宣告 SDK 的預設路徑下載不存在 SDK tag 的問題；改由固定 templates 的 Go module 讀取 SDK pin，daemon-control 預設值亦同步。保留明確 SDK 宣告的優先順序，新增無 source override 的版本拆分回歸測試與正式產物 smoke。templates／SDK 保持 0.15.2，全部 executor／lifecycle digest 不變；請由 CLI 0.15.3 升級至 0.15.4，不新增管理員重新核准要求。
+
 ## 0.15.3 (2026-10-18)
 
 - Pin templates and SDK fixtures/examples to 0.15.2, including UI 0.12.0 scaffolds, concise UI copy/tokens and delegate DTO contract checks.

package/README.md

@@ -61,6 +61,9 @@ children's `GOPRIVATE`, `GONOPROXY` and `GONOSUMDB`, preserving existing environ
 `https://github.com/synopackageland/syno-pkg-land-sdk` (check with `git ls-remote`);
 a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
+CLI-only patch releases can differ from the SDK patch. Compose import and SDK defaults
+read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
+
 `init` and `add` read their templates from `@synopackageland/templates`, an exact-pinned
 dependency. For development against local checkouts, set `SYNOPKGLAND_TEMPLATES_DIR` to a
 templates checkout and `SYNOPKGLAND_SDK_DIR` to an SDK checkout; SPKs built with

package/dist/standalone/compose.js

@@ -5,7 +5,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { parse } from "yaml";
-import { CLI_VERSION } from "../cli-version.js";
+import { templateSdkVersion } from "../template-paths.js";
 import { goChildEnv } from "../runtime/go-env.js";
 import { sdkSource } from "../runtime/sdk-source.js";
 import { readDaemon } from "./daemon.js";
@@ -69,7 +69,7 @@ export function readComposeApp(value, root, arches, fail, context = {}) {
     if (value.sdk !== undefined &&
         (typeof value.sdk !== "string" || !/^\d+\.\d+\.\d+$/.test(value.sdk)))
         return invalid("compose.sdk must name the matching SDK release.", "SDK_COMPOSE_UNSUPPORTED");
-    const sdk = typeof value.sdk === "string" ? value.sdk : (context.sdk ?? CLI_VERSION);
+    const sdk = typeof value.sdk === "string" ? value.sdk : (context.sdk ?? templateSdkVersion());
     let targets = {};
     if (value.helpers !== undefined) {
         const d = readDaemon({ exec: "_sso/gateway", targets: value.helpers }, root, arches, fail);
@@ -250,7 +250,7 @@ export function lockComposeImages(m, arch, resolveImages, imageProofs) {
     return { ...m, compose };
 }
 export function composeInputs(root, file, envFile) {
-    const result = spawnSync(planner(CLI_VERSION), [
+    const result = spawnSync(planner(templateSdkVersion()), [
         "sources",
         "--root",
         root,

package/dist/standalone/daemon.js

@@ -3,7 +3,7 @@ import { chmodSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSyn
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem, } from "../build-spk/go-toolchain.js";
 import { sdkSource, appSdkVersion } from "../runtime/sdk-source.js";
-import { CLI_VERSION } from "../cli-version.js";
+import { templateSdkVersion } from "../template-paths.js";
 import { checkCgiBinary } from "./binary.js";
 import { composeDaemon, composeNetwork } from "./compose.js";
 import { gatewayDaemon } from "./identity-gateway.js";
@@ -141,7 +141,7 @@ export async function buildDaemonControl(manifest, arch, work, run) {
             (manifest.backend.kind === "go"
                 ? appSdkVersion(manifest.backend)
                 : undefined) ??
-            CLI_VERSION).goDir,
+            templateSdkVersion()).goDir,
         env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }),
     });
     if (result.missing || result.status !== 0)

package/dist/template-paths.d.ts

@@ -3,3 +3,7 @@
  * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
  */
 export declare function templatesRoot(env?: NodeJS.ProcessEnv, from?: string): string;
+/** The installed templates' SDK pin also supplies CLI-owned runtime defaults.
+ * CLI-only patch releases must never turn their own version into an SDK tag.
+ */
+export declare function templateSdkVersion(env?: NodeJS.ProcessEnv): string;

package/dist/template-paths.js

@@ -1,5 +1,6 @@
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
+import { sdkRequirement } from "./runtime/sdk-source.js";
 /**
  * The scaffold templates come from the exactly pinned @synopackageland/templates
  * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
@@ -14,3 +15,13 @@ export function templatesRoot(env = process.env, from = import.meta.url) {
         throw new Error("[TEMPLATES_MISSING] @synopackageland/templates is not installed; reinstall @synopackageland/cli, or set SYNOPKGLAND_TEMPLATES_DIR to a templates checkout.");
     }
 }
+/** The installed templates' SDK pin also supplies CLI-owned runtime defaults.
+ * CLI-only patch releases must never turn their own version into an SDK tag.
+ */
+export function templateSdkVersion(env = process.env) {
+    const version = sdkRequirement(join(templatesRoot(env), "native-go/backend"));
+    if (!version || !/^\d+\.\d+\.\d+$/.test(version)) {
+        throw new Error("[TEMPLATES_MISSING] The installed templates have no valid SDK pin; reinstall @synopackageland/templates.");
+    }
+    return version;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.15.3",
+  "version": "0.15.4",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {

package/skills/reference/compose.md

@@ -151,7 +151,7 @@ declared availability readiness, LAN isolation/egress, protected grant lifecycle
 ACLs, two-user visibility and clean install/upgrade/reboot/stop/uninstall before
 calling the package supported on a NAS. No NAS is accessed by the build gate.
 
-The unified Compose contract uses SDK/templates 0.15.2 with CLI 0.15.3. Use the published, matching versions together; the legacy packaging route and bridge publish mode are removed.
+The unified Compose contract uses SDK/templates 0.15.2 with CLI 0.15.4. Use the published, matching versions together; the legacy packaging route and bridge publish mode are removed.
 
 Primary override files, and each included override set, must share a directory. Cross-directory override bases are rejected before loader I/O. Included implicit .env files are confined, inventoried and preserved; symlinks are rejected.