@synopackageland/cli 0.30.0 → 0.31.0

package/CHANGELOG.md

@@ -1,14 +1,19 @@
 # Changelog
 
+## 0.31.0 (2026-10-25)
+
+- Pin templates 0.31.x and SDK/App 0.31.0 defaults, including the hardened executor payloads. Rebuild Apps and obtain administrator approval for changed system-access payloads.
+
+- A bare host name now resolves to `https://host:5001` instead of `http://host:5000`; pass a full URL to keep plain HTTP.
+- JSON input duplicate-key detection is now linear-time, so large inputs no longer stall the parser.
+- The CLI's own `.env` loading now sets only `DSM_*` and `SYNOPKGLAND_*` variables; set other variables (for example `GOCACHE` or `PATH`) in the shell.
+- Harden the DSM curl fallback (headers and form fields go through a private curl config; form text is sent literally), human-readable output (control characters are escaped), `ctl` examples and package versions, the UI directory (must resolve inside the project), and standalone inspect (INFO `package` must be an SDK package id).
+
 ## 0.30.0 (2026-10-24)
 
 - Package and forward `identity_gateway.external_access.single_origin`; use SDK 0.30.0 for one-URL Apps, provider-aware DSM menu launches and launch probes.
 - Pin templates 0.30.x and its SDK/App 0.30.0 defaults; keep immutable executor/v0.27.0.
 
-## Unreleased
-
-- Accept and package `identity_gateway.external_access.single_origin` (boolean) for one-URL upstreams. Build requires SDK sources with `single_origin` support, and inspect accepts the packaged `single_origin: true` declaration.
-
 ## 0.29.0 (2026-10-24)
 
 - Depend on templates `~0.29.0` with SDK/App 0.29.0 and UI 0.14.10. SDK 0.29.0 reuses executor/v0.27.0 through executor manifest format 1; no executor digests change.

package/README.md

@@ -66,7 +66,7 @@ CLI-only patch releases can differ from the SDK patch. Compose import and SDK de
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.30.0 depends on `~0.30.0`: npm installation or
+`@synopackageland/templates`. CLI 0.31.0 depends on `~0.31.0`: npm installation or
 update can select the latest templates patch in the 0.29 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;
@@ -339,7 +339,10 @@ DSM readiness; inspect lists explicit acceptance blockers.
 ## Control installed Apps
 
 Use `synopkgland ctl host add nas --url https://nas.example:5001 --username alice`
-to register and authenticate a NAS in OS secure storage. `ctl host list --json`
+to register and authenticate a NAS in OS secure storage. A bare host name uses
+`https://<host>:5001`; provide a full URL for a different scheme or port.
+The CLI loads only `DSM_*` and `SYNOPKGLAND_*` variables from `.env`; set other
+process variables in the shell. `ctl host list --json`
 checks sessions; `ctl list --host nas --json` discovers all approved task-level
 commands and their schemas. Run the listed alias/command with typed flags,
 `--help` and `--dry-run`; writes require `--yes`. There is no mutable current

package/dist/bin.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { loadDotEnv } from "./load-env.js";
 import { runCli } from "./cli.js";
+import { terminalSafe } from "./terminal-text.js";
 loadDotEnv();
 // Package deployment is explicit; this CLI does not publish releases.
 // Successful completion leaves Node's default 0 or the command's exitCode intact.
 runCli(process.argv).catch((error) => {
-    console.error(error instanceof Error ? error.message : String(error));
+    console.error(terminalSafe(error instanceof Error ? error.message : String(error)));
     process.exit(1);
 });

package/dist/cli.js

@@ -36,6 +36,7 @@ import { checkJobs, commitOutputs, forEachArch, } from "./standalone/arch-jobs.j
 import { checkReproducible } from "./reproducible.js";
 import { spkApprovalDiff, formatApprovalDiff } from "./runtime/approval-diff.js";
 import { inspectAnySpk } from "./spk/inspect.js";
+import { terminalSafe } from "./terminal-text.js";
 function failure(code, message, hint = "Fix the configuration and retry; use --help to see command usage.") {
     return Object.assign(new Error(codedMessage(code, message)), { code, hint });
 }
@@ -295,7 +296,7 @@ export async function runCli(argv) {
     const json = argv.includes("--json");
     const stdout = console.log.bind(console);
     const progress = console.log;
-    const emit = (command, data, text) => json ? stdout(JSON.stringify({ ok: true, command, data })) : stdout(text);
+    const emit = (command, data, text) => json ? stdout(JSON.stringify({ ok: true, command, data })) : stdout(terminalSafe(text));
     const program = new Command()
         .name("synopkgland")
         .description("Syno Package Land Developer Kit CLI")

package/dist/ctl/cli.js

@@ -52,7 +52,7 @@ function q(value) { return "'" + value.replaceAll("'", "'\\''") + "'"; }
 function example(host, app, op) {
     const base = `synopkgland ctl ${app.payload.aliases[0] ?? app.payload.package.id} ${op.cli.join(' ')} --host ${host}`;
     return (op.examples?.length ? op.examples : [{}]).map(params => {
-        const simple = op.paramsSchema && Object.entries(params).every(([key, value]) => ['string', 'number', 'boolean'].includes(typeof value) && !RESERVED_FLAGS.has(flagName(key)) && op.paramsSchema?.properties?.[key]);
+        const simple = op.paramsSchema && Object.entries(params).every(([key, value]) => ['string', 'number', 'boolean'].includes(typeof value) && /^[A-Za-z][A-Za-z0-9_]*$/.test(key) && !RESERVED_FLAGS.has(flagName(key)) && op.paramsSchema?.properties?.[key]);
         if (simple)
             return base + Object.entries(params).map(([key, value]) => ' --' + flagName(key) + ' ' + q(String(value))).join('') + (op.effect === 'read' ? '' : ' --yes');
         return `printf '%s' ${q(JSON.stringify(params))} | ${base} --input -` + (op.effect === 'read' ? '' : ' --yes');

package/dist/ctl/json.js

@@ -1,9 +1,43 @@
 import { openSync, closeSync, readSync } from 'node:fs';
-import { parseDocument } from 'yaml';
+/** Linear duplicate-key scan over text that JSON.parse already accepted (yaml's uniqueKeys check is quadratic). */
+function hasDuplicateKeys(text) {
+    const stack = [];
+    let expectKey = false;
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (c === '"') {
+            let j = i + 1;
+            while (text[j] !== '"')
+                j += text[j] === '\\' ? 2 : 1;
+            const top = stack[stack.length - 1];
+            if (top && expectKey) {
+                const key = JSON.parse(text.slice(i, j + 1));
+                if (top.has(key))
+                    return true;
+                top.add(key);
+                expectKey = false;
+            }
+            i = j;
+        }
+        else if (c === '{') {
+            stack.push(new Set());
+            expectKey = true;
+        }
+        else if (c === '[') {
+            stack.push(null);
+        }
+        else if (c === '}' || c === ']') {
+            stack.pop();
+        }
+        else if (c === ',' && stack[stack.length - 1])
+            expectKey = true;
+    }
+    return false;
+}
 export function strictJson(raw) {
     const text = typeof raw === 'string' ? raw : new TextDecoder('utf-8', { fatal: true }).decode(raw);
     const value = JSON.parse(text);
-    if (parseDocument(text, { uniqueKeys: true }).errors.length)
+    if (hasDuplicateKeys(text))
         throw Error('Duplicate JSON properties');
     const check = (v, depth) => { if (depth > 32)
         throw Error('JSON too deep'); if (typeof v === 'number' && !Number.isFinite(v))

package/dist/ctl/service.js

@@ -37,7 +37,7 @@ export class CtlClient {
         const entries = response.data?.packages;
         if (!Array.isArray(entries) || response.data.total !== entries.length || entries.length > 4096)
             throw new CtlError('CTL_INVENTORY_INVALID', 'Incomplete installed-package inventory.', 'Check the DSM version and permissions.', 5);
-        return entries.map((p) => { if (typeof p.id !== 'string' || !/^[A-Za-z][A-Za-z0-9_.+-]{0,127}$/.test(p.id) || typeof p.version !== 'string')
+        return entries.map((p) => { if (typeof p.id !== 'string' || !/^[A-Za-z][A-Za-z0-9_.+-]{0,127}$/.test(p.id) || typeof p.version !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._+~-]{0,63}$/.test(p.version))
             throw new CtlError('CTL_INVENTORY_INVALID', 'Invalid package identity.', 'Check the DSM response.', 5); return { id: p.id, version: p.version, state: p.additional?.status }; });
     }
     async discover(options = {}) {

package/dist/host/credentials.js

@@ -56,7 +56,7 @@ function fromEnv(urlOverride) {
     if (urlOverride) {
         dsmOrigin = urlOverride.startsWith("http://") || urlOverride.startsWith("https://")
             ? urlOverride
-            : `http://${urlOverride}:5000`;
+            : `https://${urlOverride}:5001`;
     }
     const password = process.env.DSM_PASSWORD;
     const username = process.env.DSM_USERNAME ?? "admin";

package/dist/host/dsm-http.js

@@ -52,30 +52,44 @@ export async function dsmFetch(url, init = {}) {
         return curlFetch(url, init);
     }
 }
+function curlConfigString(value) {
+    const escapes = { "\\": "\\\\", '"': '\\"', "\t": "\\t", "\n": "\\n", "\r": "\\r", "\v": "\\v" };
+    return `"${value.replace(/[\\"\t\n\r\v]/g, (c) => escapes[c])}"`;
+}
 async function curlFetch(url, init) {
     const staging = mkdtempSync(join(tmpdir(), "synopkgland-dsm-http-"));
     const headerFile = join(staging, "headers");
     const bodyFile = join(staging, "body");
     try {
-        const args = ["-sS", "-D", headerFile, "-o", bodyFile, "-w", "%{http_code}", "-X", init.method ?? "GET"];
+        const configFile = join(staging, "config");
+        const args = ["-sS", "-D", headerFile, "-o", bodyFile, "-w", "%{http_code}", "-X", init.method ?? "GET", "-K", configFile];
+        // Headers and form text go through a private config file, not argv, and
+        // form text is sent literally (curl -F would read "@file" and "<file").
+        const config = [];
         const headers = headerRecord(init.headers);
         for (const [name, value] of Object.entries(headers)) {
             if (name.toLowerCase() === "content-type" && init.body instanceof FormData) {
                 continue;
             }
-            args.push("-H", `${name}: ${value}`);
+            if (/[\r\n\0]/.test(name + value)) {
+                throw new Error(`Invalid header value: ${name}`);
+            }
+            config.push(`header = ${curlConfigString(`${name}: ${value}`)}`);
         }
         let stdin;
         if (init.body instanceof FormData) {
             for (const [name, value] of init.body.entries()) {
                 if (typeof value === "string") {
-                    args.push("-F", `${name}=${value}`);
+                    if (/[=\0]/.test(name) || value.includes("\0")) {
+                        throw new Error(`Invalid form field: ${name}`);
+                    }
+                    config.push(`form-string = ${curlConfigString(`${name}=${value}`)}`);
                     continue;
                 }
                 const filename = "name" in value && typeof value.name === "string" ? value.name : "upload.bin";
                 const partPath = join(staging, filename);
                 writeFileSync(partPath, Buffer.from(await value.arrayBuffer()));
-                args.push("-F", `${name}=@${partPath};filename=${filename}`);
+                config.push(`form = ${curlConfigString(`${name}=@${partPath};filename=${filename}`)}`);
             }
         }
         else if (typeof init.body === "string") {
@@ -86,6 +100,7 @@ async function curlFetch(url, init) {
             stdin = Buffer.from(await new Response(init.body).arrayBuffer());
             args.push("--data-binary", "@-");
         }
+        writeFileSync(configFile, config.map((line) => line + "\n").join(""), { mode: 0o600 });
         args.push(url);
         const result = spawnSync("curl", args, { encoding: "utf8", input: stdin });
         if (result.status !== 0) {

package/dist/load-env.js

@@ -1,5 +1,8 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+// A project .env may only supply the CLI's own settings, never variables that
+// change how child tools (go, docker, curl, tar) run.
+const DOTENV_KEY = /^(?:DSM|SYNOPKGLAND)_[A-Z0-9_]+$/;
 export function loadDotEnv(fromDir = process.cwd()) {
     let current = resolve(fromDir);
     while (true) {
@@ -16,7 +19,7 @@ export function loadDotEnv(fromDir = process.cwd()) {
                 }
                 const key = trimmed.slice(0, eq).trim();
                 const value = trimmed.slice(eq + 1).trim();
-                if (process.env[key] === undefined) {
+                if (DOTENV_KEY.test(key) && process.env[key] === undefined) {
                     process.env[key] = value;
                 }
             }

package/dist/standalone/inspect-spk.js

@@ -1037,6 +1037,11 @@ function readInfo(path, findings, kind, compose = false, daemonNode) {
             findings.push(`INFO is missing ${key}`);
         }
     }
+    // Every SDK build writes this package grammar; inspect renders paths and
+    // configs from it, so anything else is not an SDK-built package.
+    if (info.package && !/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(info.package)) {
+        findings.push("INFO package is not a valid SDK package id");
+    }
     if (kind !== "container" &&
         (info.thirdparty !== "yes" || info.dsmuidir !== "ui")) {
         findings.push('INFO must have thirdparty="yes" and dsmuidir="ui" for DSM to serve /webman/3rdparty/<package>/');

package/dist/standalone/spk.js

@@ -6,9 +6,9 @@ import { resolvedSdkLaunch } from "../contract/app-launch.js";
 import { gatewayAdmissionPolicy } from "./identity-gateway.js";
 import { metadataInfoFields } from "../package-metadata.js";
 import { createHash } from "node:crypto";
-import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, realpathSync, } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, sep } from "node:path";
 import { infoArchValue } from "../build-spk/dsm-arch.js";
 import { packageIcons, writeDsmWindowIcons, writePackageCenterIcons, } from "../build-spk/dsm-icons.js";
 import { renderNativePrivilege } from "../build-spk/native-lifecycle.js";
@@ -78,7 +78,7 @@ export async function assembleStandaloneSpk(options) {
         const uiRoot = join(staging, "package", "ui");
         const appDir = join(uiRoot, "app");
         if (hasSdkWindow(manifest))
-            copyUiTree(manifest.ui.dir, appDir);
+            copyUiTree(manifest.ui.dir, appDir, manifest.root);
         else
             mkdirSync(appDir, { recursive: true });
         const assetVersion = digestTree(appDir).slice(0, 12);
@@ -386,12 +386,17 @@ export function renderInfo(manifest, arch, checksum, executorDigest) {
         fields.push(['startstop_restart_services', 'nginx.service']);
     return portalInfoFields(fields, Boolean(manifest.portal) || nginx).map(([key, value]) => `${key}=${quote(value)}\n`).join("");
 }
-function copyUiTree(source, target) {
+function copyUiTree(source, target, root) {
     for (const entry of ["app.js", "app.css"]) {
         if (!existsSync(join(source, entry))) {
             throw new StandaloneBuildError("STANDALONE_UI_ENTRY_MISSING", `The UI directory is missing ${entry}: ${source}`);
         }
     }
+    const real = realpathSync(source);
+    const realRoot = realpathSync(root);
+    if (real !== realRoot && !real.startsWith(realRoot + sep)) {
+        throw new StandaloneBuildError("STANDALONE_UI_SYMLINK", `The UI directory must resolve inside the project: ${source}`);
+    }
     let total = 0;
     const walk = (from, to) => {
         mkdirSync(to, { recursive: true });

package/dist/terminal-text.d.ts

@@ -0,0 +1 @@
+export declare function terminalSafe(text: string): string;

package/dist/terminal-text.js

@@ -0,0 +1,5 @@
+// Package-supplied strings (INFO fields, file names, DSM data) reach human
+// output; show control characters as escapes so they cannot drive the terminal.
+export function terminalSafe(text) {
+    return text.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, (c) => `\\x${c.charCodeAt(0).toString(16).padStart(2, "0")}`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.30.0",
+  "version": "0.31.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "~0.30.0",
+    "@synopackageland/templates": "~0.31.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",