@synopackageland/cli 0.17.5 → 0.17.6

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.17.6 (2026-10-20)
+
+- Inspect sharedFolder, Portal and install-selected Apps by reconstructing fixed lifecycle scripts from their complete inputs, including native HTTPS ingress and App hooks.
+
 ## 0.17.5 (2026-10-20)
 
 - Run native HTTPS preparation inside the SDK lifecycle steps before App hooks, keeping generated hook wrappers inspectable.

package/dist/standalone/inspect-spk.js

@@ -28,7 +28,7 @@ import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, BRIDGE_WORKER_ARGS, bac
 import { renderStandaloneResource } from "./resource.js";
 import { recoverSharedFolder, renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps, SHARED_FOLDER_MARKER, } from "./shared-folder.js";
 import { renderInstallWizardFiles, renderNativeInstallWizard, } from "../build-spk/install-wizard.js";
-import { renderDelegateScopeSteps, renderDelegateInstallDraft, } from "../build-spk/delegate-scope.js";
+import { renderDelegateScopeSteps, } from "../build-spk/delegate-scope.js";
 import { renderUninstallWizardFiles } from "../build-spk/uninstall-wizard.js";
 import { renderNativePrivilege } from "../build-spk/native-lifecycle.js";
 import { renderUiConfig } from "./dsm-window.js";
@@ -162,7 +162,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             : undefined;
         // Resource-worker portals use DSM-owned INFO reload, with no executor requirement.
         const portal = standalone
-            ? await recoverPortal(dir, info, `SYNO.SDS.${info.package}.Instance`, paths, payload, findings)
+            ? await recoverPortal(dir, info, `SYNO.SDS.${info.package}.Instance`, paths, payload, findings, nativeGateway)
             : undefined;
         if (portal &&
             info.os_min_ver &&
@@ -269,7 +269,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             ? await inspectLoginStyle(dir, info.package, Boolean(portal || executor?.policy.portal), findings)
             : undefined;
         if (standalone)
-            checkSharedFolder(dir, findings, info.package, sharedFolder, executor?.policy.scope === "install-selected", portal, hasExecutor);
+            checkSharedFolder(dir, findings, info.package, sharedFolder, executor?.policy.scope === "install-selected", portal, hasExecutor, nativeGateway, info.os_min_ver);
         const icon = inspectPackageIcons(dir, findings);
         const cgiEntry = payload.find((entry) => entry.path === CGI_PAYLOAD_PATH);
         if (standalone && !cgiEntry) {
@@ -1081,7 +1081,7 @@ function checkBackground(dir, info, payload, findings, executor, daemon, bridge
  * declaration (without one, any present file must be the default native
  * install wizard), and no other install/upgrade wizard file may exist.
  */
-function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal, executor = false) {
+function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal, executor = false, nativeGateway, osMinVer) {
     const wizardDir = join(dir, "WIZARD_UIFILES");
     const present = (existsSync(wizardDir) ? readdirSync(wizardDir) : [])
         .filter((name) => /^(install|upgrade)_uifile(_|\.|$)/.test(name))
@@ -1091,6 +1091,22 @@ function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal,
         findings.push("the install.sharedFolder declaration in scripts/postinst is invalid");
     if (!pkg)
         return;
+    // App wrappers have already been validated and unwrapped. Reconstruct the
+    // remaining install-hook inputs from INFO, the payload and its build record.
+    const lifecycleManifest = {
+        package: pkg,
+        os_min_ver: osMinVer,
+        sharedFolder: folder,
+        capabilities: selected
+            ? { delegate: { scope: "install-selected" } }
+            : executor
+                ? { rootOps: true }
+                : {},
+        ...(nativeGateway
+            ? { identityGateway: nativeGateway }
+            : {}),
+        ...portalManifest(portal),
+    };
     const wizards = expectedWizardFiles(pkg, folder, selected, portal);
     const source = selected
         ? "the install-selected policy"
@@ -1110,25 +1126,17 @@ function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal,
         findings.push(`WIZARD_UIFILES/${name} is not a wizard file produced by ${source}`);
     if (selected) {
         for (const hook of ["preinst", "postinst"]) {
-            if (!readOptional(join(dir, "scripts", hook))?.includes(renderDelegateInstallDraft(pkg, hook === "preinst")))
-                findings.push(`scripts/${hook} missing install-selected draft handling`);
+            if (readOptional(join(dir, "scripts", hook)) !==
+                renderStandaloneScript(hook, lifecycleManifest))
+                findings.push(`scripts/${hook} does not match the fixed install-selected draft handling`);
         }
     }
-    if (!folder)
+    if (!folder && !portal)
         return;
     for (const hook of ["postinst", "postupgrade"]) {
         if (readOptional(join(dir, "scripts", hook)) !==
-            renderStandaloneScript(hook, {
-                package: pkg,
-                sharedFolder: folder,
-                ...(selected
-                    ? { capabilities: { delegate: { scope: "install-selected" } } }
-                    : executor
-                        ? { capabilities: { rootOps: true } }
-                        : {}),
-                ...portalManifest(portal),
-            })) {
-            findings.push(`scripts/${hook} does not match the fixed script declared by install.sharedFolder`);
+            renderStandaloneScript(hook, lifecycleManifest)) {
+            findings.push(`scripts/${hook} does not match the fixed script declared by ${folder ? "install.sharedFolder" : "portal"}`);
         }
     }
 }
@@ -1160,7 +1168,7 @@ function portalManifest(portal) {
  * files and alias lifecycle must be exactly what the generator writes for the
  * package's own DSM window (native AppInstance or Compose `.url` entry); activation is never part of the package.
  */
-async function recoverPortal(dir, info, appId, paths, payload, findings) {
+async function recoverPortal(dir, info, appId, paths, payload, findings, nativeGateway) {
     const files = [PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH];
     if (!files.some((path) => paths.has(path)))
         return;
@@ -1184,7 +1192,14 @@ async function recoverPortal(dir, info, appId, paths, payload, findings) {
                 renderPortalMustache())
             throw new Error("content");
         for (const hook of ["preinst", "postinst", "postupgrade"]) {
-            if (!readOptional(join(dir, "scripts", hook))?.startsWith(`#!/bin/sh\n${renderPortalLifecycle(hook, portal)}`))
+            const prepare = ["postinst", "postupgrade"].includes(hook)
+                ? renderNativeGatewayPrepare({
+                    package: info.package,
+                    os_min_ver: info.os_min_ver,
+                    identityGateway: nativeGateway,
+                })
+                : "";
+            if (!readOptional(join(dir, "scripts", hook))?.startsWith(`#!/bin/sh\n${prepare}${renderPortalLifecycle(hook, portal)}`))
                 throw new Error(hook);
         }
         return portal;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.17.5",
+  "version": "0.17.6",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {