@synopackageland/cli 0.17.5 → 0.17.7

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.17.7 (2026-10-20)
+
+- Inspect Compose Apps with custom icons and localized titles using their archived build inputs, preserving every icon size and strict launcher validation. Preserve declared daemon uninstall hooks when checking fixed lifecycle scripts.
+
+## 0.17.6 (2026-10-20)
+
+- Inspect sharedFolder, Portal and install-selected Apps by reconstructing fixed lifecycle scripts from their complete inputs, including native HTTPS ingress and App hooks.
+
 ## 0.17.5 (2026-10-20)
 
 - Run native HTTPS preparation inside the SDK lifecycle steps before App hooks, keeping generated hook wrappers inspectable.

package/dist/build-spk/dsm-icons.d.ts

@@ -34,5 +34,7 @@ export declare function iconReport(root: string, icon: string | undefined): Icon
  */
 export declare function windowIconTemplate(icons: PackageIcons): string;
 export declare function windowIconFile(icons: PackageIcons, size: number): string;
+/** Recover the build's exact icon inputs from an SPK, including hand-drawn sizes. */
+export declare function readDsmWindowIcons(uiDir: string): PackageIcons;
 export declare function writeDsmWindowIcons(uiDir: string, icons: PackageIcons): void;
 export declare function writePackageCenterIcons(spkRoot: string, icons: PackageIcons): void;

package/dist/build-spk/dsm-icons.js

@@ -149,6 +149,36 @@ export function windowIconTemplate(icons) {
 export function windowIconFile(icons, size) {
     return windowIconTemplate(icons).replace("{0}", String(size));
 }
+/** Recover the build's exact icon inputs from an SPK, including hand-drawn sizes. */
+export function readDsmWindowIcons(uiDir) {
+    const dir = join(uiDir, "images");
+    const candidates = readdirSync(dir).filter(name => /^app_[a-f0-9]{12}_256\.png$/.test(name));
+    if (candidates.length !== 1)
+        throw new Error("expected one complete DSM window icon set");
+    const template = candidates[0].replace(/_256\.png$/, "_{0}.png");
+    const window = new Map();
+    let solid = false;
+    for (const size of WINDOW_ICON_SIZES) {
+        const name = template.replace("{0}", String(size));
+        const bytes = readFileSync(join(dir, name));
+        if (bytes.length > MAX_ICON_BYTES)
+            throw new Error(`${name}: invalid DSM window icon`);
+        const image = decodePng(bytes);
+        if (image.width !== size || image.height !== size)
+            throw new Error(`${name}: invalid DSM window icon`);
+        if (size === 256)
+            solid = isSolid(image);
+        window.set(size, bytes);
+    }
+    const icons = {
+        source: window.get(256).equals(defaultPackageIcons().packageIcon256) ? "default" : "custom",
+        window, solid,
+        packageIcon: window.get(64), packageIcon256: window.get(256),
+    };
+    if (windowIconTemplate(icons) !== `images/${template}`)
+        throw new Error("DSM window icon filenames differ from their content hash");
+    return icons;
+}
 export function writeDsmWindowIcons(uiDir, icons) {
     mkdirSync(join(uiDir, "images"), { recursive: true });
     for (const [size, png] of icons.window)

package/dist/standalone/inspect-spk.js

@@ -24,11 +24,12 @@ import { daemonConfig, readDaemon, readLifecycleTimeouts } from "./daemon.js";
 import { ROOT_SCRIPT_HINTS } from "./root-ops.js";
 import { DELETE_STATE_KEY } from "../build-spk/uninstall-wizard.js";
 import { readUninstallRecord, stateItemTexts } from "./uninstall.js";
+import { DSM_LANGS } from "./i18n.js";
 import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, BRIDGE_WORKER_ARGS, backgroundUnitName, renderBackgroundUnit, } from "./background.js";
 import { renderStandaloneResource } from "./resource.js";
 import { recoverSharedFolder, renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps, SHARED_FOLDER_MARKER, } from "./shared-folder.js";
 import { renderInstallWizardFiles, renderNativeInstallWizard, } from "../build-spk/install-wizard.js";
-import { renderDelegateScopeSteps, renderDelegateInstallDraft, } from "../build-spk/delegate-scope.js";
+import { renderDelegateScopeSteps, } from "../build-spk/delegate-scope.js";
 import { renderUninstallWizardFiles } from "../build-spk/uninstall-wizard.js";
 import { renderNativePrivilege } from "../build-spk/native-lifecycle.js";
 import { renderUiConfig } from "./dsm-window.js";
@@ -39,7 +40,7 @@ import { listPortExposures, loadCompose } from "../compose/analyze.js";
 import { uninstallCleanup, } from "../runtime/uninstall-cleanup.js";
 import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderPortalLifecycle, renderPortalMustache, renderPortalWizardStep, } from "../portal/package.js";
 import { isPortalAlias } from "../portal/alias.js";
-import { defaultPackageIcons, MAX_ICON_BYTES } from "../build-spk/dsm-icons.js";
+import { defaultPackageIcons, MAX_ICON_BYTES, readDsmWindowIcons } from "../build-spk/dsm-icons.js";
 import { isDefaultLoginAsset } from "../build-spk/login-style.js";
 import { decodePng } from "../build-spk/png.js";
 /** The SPK kind of each sdk-package.json backend a CGI is built for: Go itself, or the runtime of an App in another language. */
@@ -162,7 +163,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             : undefined;
         // Resource-worker portals use DSM-owned INFO reload, with no executor requirement.
         const portal = standalone
-            ? await recoverPortal(dir, info, `SYNO.SDS.${info.package}.Instance`, paths, payload, findings)
+            ? await recoverPortal(dir, info, `SYNO.SDS.${info.package}.Instance`, paths, payload, findings, nativeGateway)
             : undefined;
         if (portal &&
             info.os_min_ver &&
@@ -198,7 +199,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (standalone && portal)
             findings.push(...inspectPortalInfo(info, hasExecutor));
         const daemon = standalone
-            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined, nativeGateway)
+            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined, nativeGateway, uninstallHook?.uninstall)
             : undefined;
         if (background)
             checkBackground(dir, info, payload, findings, hasExecutor, daemon, kind !== "native-go", metadata.lifecycleTimeouts);
@@ -269,7 +270,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             ? await inspectLoginStyle(dir, info.package, Boolean(portal || executor?.policy.portal), findings)
             : undefined;
         if (standalone)
-            checkSharedFolder(dir, findings, info.package, sharedFolder, executor?.policy.scope === "install-selected", portal, hasExecutor);
+            checkSharedFolder(dir, findings, info.package, sharedFolder, executor?.policy.scope === "install-selected", portal, hasExecutor, nativeGateway, info.os_min_ver);
         const icon = inspectPackageIcons(dir, findings);
         const cgiEntry = payload.find((entry) => entry.path === CGI_PAYLOAD_PATH);
         if (standalone && !cgiEntry) {
@@ -627,6 +628,7 @@ async function inspectUnifiedCompose(dir, payload, metadata, findings) {
             displayname: info.displayname,
             description: info.description,
             maintainer: info.maintainer,
+            i18n: { info: archivedInfoTranslations(info) },
             os_min_ver: info.os_min_ver,
             build: Number(info.version?.split("-").pop()),
             arches: [arch],
@@ -653,7 +655,10 @@ async function inspectUnifiedCompose(dir, payload, metadata, findings) {
             throw new Error("unexpected worker resource; unapproved Shares must never auto-acquire");
         if (readdirSync(join(dir, "conf")).some((n) => !["privilege", ...(resource ? ["resource"] : [])].includes(n)))
             throw new Error("unexpected Compose resource");
-        if (readOptional(join(root, "ui/config")) !== renderUiConfig(manifest))
+        // Replay build's shared renderer with the archived bytes, never a project
+        // path or the SDK default. Each hand-drawn icon size affects the URL hash.
+        const icons = readDsmWindowIcons(join(root, "ui"));
+        if (readOptional(join(root, "ui/config")) !== renderUiConfig(manifest, icons))
             throw new Error("LAUNCHER_TYPE_MISMATCH classless Compose must use the shared url launcher");
         if (g &&
             (cfg.package !== info.package ||
@@ -787,7 +792,7 @@ async function recoverCompose(dir, value, findings) {
         return undefined;
     }
 }
-async function checkDaemon(dir, info, paths, payload, findings, executor, background, combined, nativeGateway) {
+async function checkDaemon(dir, info, paths, payload, findings, executor, background, combined, nativeGateway, uninstall) {
     if (![...paths].some((path) => path.startsWith("daemon/")))
         return;
     if (info.precheckstartstop !== "yes")
@@ -843,6 +848,7 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
             root: dir,
             ...(combined ? { lifecycleTimeouts: daemon.timeouts } : {}),
             daemon,
+            uninstall,
             ...combined,
             capabilities: {
                 ...(executor ? { rootOps: true } : {}),
@@ -879,6 +885,22 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
         findings.push("daemon/config.json or the payload does not match the fixed daemon contract");
     }
 }
+/** INFO retains the localized title inputs used by build's ui/config renderer. */
+function archivedInfoTranslations(info) {
+    const translations = {};
+    for (const [locale, lang] of Object.entries(DSM_LANGS)) {
+        if (locale === "en")
+            continue;
+        const displayname = info[`displayname_${lang}`];
+        const description = info[`description_${lang}`];
+        if (displayname || description)
+            translations[locale] = {
+                ...(displayname ? { displayname } : {}),
+                ...(description ? { description } : {}),
+            };
+    }
+    return translations;
+}
 function readInfo(path, findings, kind, compose = false) {
     if (!existsSync(path)) {
         findings.push("INFO is missing");
@@ -1081,7 +1103,7 @@ function checkBackground(dir, info, payload, findings, executor, daemon, bridge
  * declaration (without one, any present file must be the default native
  * install wizard), and no other install/upgrade wizard file may exist.
  */
-function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal, executor = false) {
+function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal, executor = false, nativeGateway, osMinVer) {
     const wizardDir = join(dir, "WIZARD_UIFILES");
     const present = (existsSync(wizardDir) ? readdirSync(wizardDir) : [])
         .filter((name) => /^(install|upgrade)_uifile(_|\.|$)/.test(name))
@@ -1091,6 +1113,22 @@ function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal,
         findings.push("the install.sharedFolder declaration in scripts/postinst is invalid");
     if (!pkg)
         return;
+    // App wrappers have already been validated and unwrapped. Reconstruct the
+    // remaining install-hook inputs from INFO, the payload and its build record.
+    const lifecycleManifest = {
+        package: pkg,
+        os_min_ver: osMinVer,
+        sharedFolder: folder,
+        capabilities: selected
+            ? { delegate: { scope: "install-selected" } }
+            : executor
+                ? { rootOps: true }
+                : {},
+        ...(nativeGateway
+            ? { identityGateway: nativeGateway }
+            : {}),
+        ...portalManifest(portal),
+    };
     const wizards = expectedWizardFiles(pkg, folder, selected, portal);
     const source = selected
         ? "the install-selected policy"
@@ -1110,25 +1148,17 @@ function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal,
         findings.push(`WIZARD_UIFILES/${name} is not a wizard file produced by ${source}`);
     if (selected) {
         for (const hook of ["preinst", "postinst"]) {
-            if (!readOptional(join(dir, "scripts", hook))?.includes(renderDelegateInstallDraft(pkg, hook === "preinst")))
-                findings.push(`scripts/${hook} missing install-selected draft handling`);
+            if (readOptional(join(dir, "scripts", hook)) !==
+                renderStandaloneScript(hook, lifecycleManifest))
+                findings.push(`scripts/${hook} does not match the fixed install-selected draft handling`);
         }
     }
-    if (!folder)
+    if (!folder && !portal)
         return;
     for (const hook of ["postinst", "postupgrade"]) {
         if (readOptional(join(dir, "scripts", hook)) !==
-            renderStandaloneScript(hook, {
-                package: pkg,
-                sharedFolder: folder,
-                ...(selected
-                    ? { capabilities: { delegate: { scope: "install-selected" } } }
-                    : executor
-                        ? { capabilities: { rootOps: true } }
-                        : {}),
-                ...portalManifest(portal),
-            })) {
-            findings.push(`scripts/${hook} does not match the fixed script declared by install.sharedFolder`);
+            renderStandaloneScript(hook, lifecycleManifest)) {
+            findings.push(`scripts/${hook} does not match the fixed script declared by ${folder ? "install.sharedFolder" : "portal"}`);
         }
     }
 }
@@ -1160,7 +1190,7 @@ function portalManifest(portal) {
  * files and alias lifecycle must be exactly what the generator writes for the
  * package's own DSM window (native AppInstance or Compose `.url` entry); activation is never part of the package.
  */
-async function recoverPortal(dir, info, appId, paths, payload, findings) {
+async function recoverPortal(dir, info, appId, paths, payload, findings, nativeGateway) {
     const files = [PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH];
     if (!files.some((path) => paths.has(path)))
         return;
@@ -1184,7 +1214,14 @@ async function recoverPortal(dir, info, appId, paths, payload, findings) {
                 renderPortalMustache())
             throw new Error("content");
         for (const hook of ["preinst", "postinst", "postupgrade"]) {
-            if (!readOptional(join(dir, "scripts", hook))?.startsWith(`#!/bin/sh\n${renderPortalLifecycle(hook, portal)}`))
+            const prepare = ["postinst", "postupgrade"].includes(hook)
+                ? renderNativeGatewayPrepare({
+                    package: info.package,
+                    os_min_ver: info.os_min_ver,
+                    identityGateway: nativeGateway,
+                })
+                : "";
+            if (!readOptional(join(dir, "scripts", hook))?.startsWith(`#!/bin/sh\n${prepare}${renderPortalLifecycle(hook, portal)}`))
                 throw new Error(hook);
         }
         return portal;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.17.5",
+  "version": "0.17.7",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {